9Oca
ARP poisoning NAC
I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning. As seen here Bypassing Trustwave NAC, it looks like a good method, but I don't simply get it. With ARP poisoning, the NAC device should send an ARP reply to any device which isnt on the trusted list. But this reply must be faster than reply of legitimate computer within network. What happens if any computer which is alive, answers faster for that ARP who-has packet? Any good explanation regarding this NAC technique?
