Re: Linux kernel 2.4 "weak end host" issue (previously discussed here as "arp problem")

From: Dax Kelson (dax@gurulabs.com)
Date: 05/11/02 

Date: Sat, 11 May 2002 02:31:47 -0600 (MDT)
From: Dax Kelson <dax@gurulabs.com>
To: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>

On Thu, 9 May 2002, Felix von Leitner wrote:

> A service bound to the IP of eth1 is still visible from eth0.
> This is not an RFC violation (RFC1122 calls this "weak end host"), but

Linux isn't unique in this regard as Solaris has the same behavior. You
are correct in that although likely surprising, it isn't a RFC violation.

On Solaris you can turn this behavior off with:

# ndd -set /dev/ip ip_strict_dst_multihoming 1

On Linux, you could use this IP Tables command (eth0 external, and eth1
internal):

# iptables -A INPUT -i eth0 -d IP_of_eth1 -j DROP

Lastly, I would comment that most likely the internal interface would be
using RFC1918 reserved address space, so an attacker 'out on the net'
somewhere wouldn't be able to route packets to the potential vicitim's
internal IP address.

Dax Kelson
Guru Labs

Relevant Pages

  • Re: Configure two gateways
    ... I have two NIC's on my linux box. ... eth0 is connected to ... gateway 192.168.1.1 ... allow-hotplug eth1 ...
    (Debian-User)
  • eth1 not working
    ... I have two network cards in my linux box, eth0 and eth1. ...
    (comp.os.linux.networking)
  • Bridging
    ... I've a linux box with say, eth0, eth1. ... My first thought was to create a bridge containing ppp0 and eth1, ...
    (comp.os.linux.networking)
  • Re: [opensuse] Would like explanation from networking guru
    ... And 192.168.11.1 is the gateway between Linux network and Windows network? ...
    (SuSE)
  • Re: route command baffles me.
    ... when you do ifconfig -a under with eth1 down, ... something "the solaris way" when this ain't solaris. ... be quicker to recognize that eth0 was set up as i wanted. ...
    (comp.os.linux.networking)