Re: [fw-wiz] Windows dynamic ARP


I don't think this will help. The Gratuitous ARP is sent out when the windows machine is first booting up--it is checking to see if it is duplicating anybody's IP address.

--p

-----Original Message-----
From: firewall-wizards-bounces@xxxxxxxxxxxxxxxxxxxxx
[mailto:firewall-wizards-bounces@xxxxxxxxxxxxxxxxxxxxx]On Behalf Of John
Mason Jr
Sent: Wednesday, November 26, 2008 11:33 AM
To: Firewall Wizards Security Mailing List
Subject: Re: [fw-wiz] Windows dynamic ARP


Paul D. Robertson wrote:
On Wed, 26 Nov 2008, Darden, Patrick S. wrote:


Some possibilities you might have already thought of for doing this in a
roundabout fashion:

1. If you are using advanced switches, you can implement this on them.
Allow only certain MACs to connect to your network. 2. If your switches


I can MAC-lock switch ports, however what I'm looking for is a host-level
backup to MAC locking the network layer, so that if there's a network
compromise, or a hub is introduced in to the physical topology the game is
not immediately lost.


don't have the ability to do #1, perhaps your switches, core switches,
or core router can filter out ARP requests/replies. 3. You can turn off


ARP won't cross a router- I'm specifically trying to shore up the host OS
so that the host/network seperation still happens, but there's a layer of
protection if the network layer or administrator is compromised.


ARP response in windows (not quite what you wanted, I think)
http://www.windowsreference.com/networking/enabledisable-response-to-arp-request-without-unicase-source-ethernet-address/



Hmm, that looks mostly like it's a unicast/multi-and-broadcast switch-
maybe there's someone who's done enough firewall code who can point me to
a good shim location? The built-in firewall seems to be IP layer only.

I'm going to have a good play with /32ing the subnet mask and adding a
routing table entry for each host, but I really think that's going to end
up being sub-optimal- as is adding a null static entry for every IP
address I don't want to communicate with in the subnet (I'm betting the
ARP table is a linear search in most network stacks.)

Paul

How about this:

<http://www.windowsreference.com/windows-vista/set-gratuitous-arp-requests-in-windows-server-2008-and-windows-vista/>



John

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: [fw-wiz] Windows dynamic ARP
    ... If you are using advanced switches, you can implement this on them. ... Allow only certain MACs to connect to your network. ... protection if the network layer or administrator is compromised. ... The built-in firewall seems to be IP layer only. ...
    (Firewall-Wizards)
  • Re: abnormal (excessive) number of arp requests on subnet?
    ... How "busy" is the network - how many hosts talking to how ... Why is there such a lot of ARP ... If using switches, ...
    (comp.os.linux.networking)
  • Re: get MAC Address from IP
    ... a machine may have multiple IP addresses and multiple MAC ... Its called ARP. ... Also, IN GENERAL, it's a bad idea for code which is not running the network ... Note that the network layer won't be troubled by this change, ...
    (microsoft.public.dotnet.general)
  • Re: Tracking down a device with the wrong IP address?
    ... check the arp table in your switches, they will show you exactly where it is ... There is a device on the network with the wrong IP address. ... from the mac but I'm not sure how much else I can get. ...
    (microsoft.public.windows.server.networking)
  • Which port is traffic coming from?
    ... I'm seeing an awful lot of weird ARP broadcasts: ... I do not use any 172 addresses on this network. ... associated with these broadcasts doesn't show up on any ARP tables... ... not the switches, ...
    (comp.dcom.sys.cisco)