Investigating an ARP Spoofing Attack
CyberOps Case 01 write-up covering ARP spoofing, IP impersonation, and a Man-in-the-Middle attack found in packet evidence.
Case 01
Score: 19 / 20
Evidence Provided
- One
pcap-filenetwork capture
This was the first practical investigation case I completed as part of my CyberOps coursework. A network traffic capture was provided for analysis, and I used Wireshark to determine what had happened and document the findings clearly.
The scenario involved HaiTek Company Ltd, where suspicious activity suggested that sensitive archive-server traffic may have been exposed. The goal was to examine the supplied PCAP, identify the relevant hosts, and explain whether the packet evidence supported a real incident.
The investigation focused on IP and MAC address relationships in the capture. The key anomaly was that Peter Sunshine’s IP address, 172.17.0.40, appeared in the ARP table with two different MAC addresses at the same time. From there, I followed the traffic involving the archive server and correlated the suspicious activity with a Raspberry Pi device.
The evidence indicated an ARP spoofing attack. The Raspberry Pi impersonated Peter’s network identity, positioned itself as a Man-in-the-Middle, and was able to see the archive-server traffic related to the offer file Peter was viewing. After that activity ended, the Raspberry Pi left the network and Peter’s correct MAC address returned to the ARP table.
Full Investigation Report
The full investigation report, including the supporting packet-analysis evidence and final conclusion, can be viewed below. The report was originally written in Finnish; this English version is otherwise similar in content.