In wired networks, Medium Access Control (MAC) spoofing is a well-known and extensively studied class of network security attacks in which an adversary impersonates a legitimate host by falsifying its MAC address. Despite existing defense stan- dards, such attacks remain relevant in contemporary networks. MAC spoofing can enable Man-In-The-Middle (MITM) attacks, allowing an attacker to intercept and inject traffic while posing as the victim whose MAC address has been compromised. Despite its conceptual simplicity, implementing a fully transparent MAC spoofing MITM attack is non-trivial. Existing techniques fail to maintain transparency from the victim’s perspective and may disrupt connectivity. While traffic interception is relatively straightforward, injecting traffic on behalf of the victim without affecting the victim’s normal operation is more challenging. Achieving such transparency typically requires custom code and specialized libraries that may lack portability across platforms or operate in user space rather than kernel space, thereby imposing performance limitations. This demo presents an implementation of a MAC spoofing-based MITM attack that enables transparent interception and injection of packets while impersonating the victim, without requiring custom code. The approach operates entirely in kernel space, leveraging Linux networking names- paces, and ensures complete transparency to both the victim host and its communication endpoint.

Remote peering (RP) enables networks to reach Internet Exchange Points (IXPs) without physical presence in the same datacenter/location, offering cost-effective interconnection. However, in the context of anycast, where routing efficiency relies on the assumption that traffic is routed to the geographically nearest instance, RP can undermine this principle by introducing hidden performance costs and inflating paths. This paper presents a hybrid methodology, combining data-plane measurements with control-plane insights, to detect and geolocate RP links at scale using IP-level geolocation, AS-level mapping, and IXP facility data. Using 3 million traceroutes targeting 13,735 anycast /24-prefixes, we quantify the impact of RP on anycast routing.Our analysis shows that whilst RP is widespread, it often connects ASes geographically close to the IXP facility. However, for cases where it is “remote” we find it frequently results in long detours, elevated latency, and sub-optimal anycast site selection. Finally, we identify key ASes and IXP regions that play a central role in driving RP-related detours and locality violations in anycast routing. Our findings demonstrate at Internet scale that RP undermines anycast locality by increasing the likelihood of detours and inflated paths, underscoring the need for improved visibility into interconnection practices that impact latency-sensitive services.

The security of Border Gateway Protocol (BGP) operations at Internet Exchange Points (IXPs) is critical to ensuring the integrity of data exchanges between Internet Service Providers (ISPs). A key challenge in BGP is its trust-based route sharing, which introduces vulnerabilities that attackers can exploit to hijack or disrupt traffic. While mechanisms like Internet Routing Registries (IRRs) and the Resource Public Key Infrastructure (RPKI) have been developed to mitigate these risks, their effectiveness is often undermined by inherent design flaws that limit their reliability. This paper presents a novel tool designed to address these security gaps in IXP infrastructures. By analyzing the Routing Information Base (RIB) of an IXP’s route server, the tool identifies possible prefix hijacking attacks. These prefixes serve as input for calculating a Risk Level metric for each Autonomous System (AS), offering IXP operators insights into anomalous behaviors. The effectiveness of the metric is validated through its application to well-known attack scenarios. Finally, we showcase the application of this tool through an analysis of real-world data from the route server of a major Italian IXP.