Re: Fwd: MAC / IP conflict

From: Bill Davidsen
Date: Mon Mar 29 2004 - 17:04:46 EST

Willy Tarreau wrote:

On Sun, Mar 28, 2004 at 10:58:16PM -0500, Bill Davidsen wrote:

Jad Saklawi wrote:

----- Forwarded message from Hisham Mardam Bey -----
Date: Sun, 21 Mar 2004 13:52:59 +0200

In short, I need to detect when someone on the network uses my MAC and
my IP address.

Longer story follows. I am on a LAN which might have some potentially
dangerous users. Those users might spoof my MAC address and additionally
use my IP address, thus forcing my box to go offline, and not be able to
communicate with my gateway. What I need is a passive way to check for
something of the sort, and perhaps a notofication into syslog (the
latter is not very important).

Use arpwatch, it detects ALL changes of IP<=>MAC mapping.

It won't tell him when someone else uses both IP and MAC. The real solution
is to lock the MAC on the switch if possible. Another one is to use a second
host to launch regular ARP requests and count how many replies it gets. Note
that it is also possible to do this from his host, but he will need arping
and tcpdump in promiscuous mode, because the reply address will have to be
a fake one (MAC and IP) so that the switch forwards the reply on all ports.

If he sees the packet it should alert on the local MAC or IP on an external packet. As noted you won't get the external packet in all cases.

Completely passive solution will not always detect the event. The attacker
might send packets to another host or even to the switch itself, which will
not propagate to other ports (eg: ethernet loopback with SA=DA= his MAC).
But if they make a mistake, then listening to all incoming packets and logging
their source MAC when it's the same as his host might work. This can be
implemented very easily with arptables but just for ARP requests. ebtables
might be better suited, but needs to configure a bridge which is dangerous.

I like the idea of sending ARP after changing the MAC. I would hope to have an option in the switch which prevents MAC takeover by locking the MAC to a port as long as the link is up. This doesn't prevent sending a packet to another host with the real (evil) MAC and spoofed IP, to set the arptable in a single host. In the long run help from the switch is probably needed to do it right.

-bill davidsen (davidsen@xxxxxxx)
"The secret to procrastination is to put things off until the
last possible moment - but no longer" -me
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at