Re: MAC Bindings

From: Richard Arends (richard@unixguru.nl)
Date: 08/23/01 

Date: Thu, 23 Aug 2001 12:17:06 +0200 (CEST)
From: Richard Arends <richard@unixguru.nl>
To: "m.s." <ms@shanock.com>
Subject: Re: MAC Bindings
Message-ID: <Pine.BSO.4.33.0108231211310.10848-100000@mail.unixguru.nl>

On Wed, 22 Aug 2001, m.s. wrote:

> I'm faced with the problem of configuring a Linux router to prevent hosts
> on the network from spoofing ARP requests to prevent ARP-based MiM
> attacks on the network. I haven't been able to find any documentations on
> this matter, and thought asking here would be appropriate. The machine is
> running Linux 2.2.19.

You can disable arp on youre NIC with ifconfig (-arp or noarp). Then you
have to build a static arp-table for that NIC where al the hosts in your
are listed in with arp -s.

For a small network this shouldn't be a problem. For a large network this
is a lot of work, but there you can use a database with all the mac's
listed in. Then build a program (script) that query's the database and
builds the arp table.

Greetings,

Richard.

Relevant Pages

  • Re: mac to ip address tools
    ... networks (when deploying an IDS, to determine which hosts are up, what ... you can "force" traffic by doing a ping sweep of the network so ... you get both the ARP replies ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: switched n/w
    ... > Iam a bit new to network securities.We have a switched network and to ... For example, i make a fake arp entry in the victims arp table, ... that some of your hosts has been compromised. ...
    (Security-Basics)
  • RE: Using ARP to map a network
    ... would that mean "mapping a network without sending out any packet"? ... mapping services and hosts on the local network ... spoofing ARP Replies, sending your MAC out for every known IP, and then ... >>> This list is provided by the SecurityFocus Security ...
    (Pen-Test)
  • Re: MAC Bindings
    ... > I'm faced with the problem of configuring a Linux router to prevent hosts ... > on the network from spoofing ARP requests to prevent ARP-based MiM ...
    (Focus-Linux)
  • Re: Residual arp traffic ! ;D
    ... > network with certain traffic. ... > and doing some packet capturing, I see something looking for hosts on ... Every minute or so the server sends out arp ... > packets for hosts on the old LAN. ...
    (comp.os.linux.networking)