* arp poisoning?
@ 2005-02-10 12:19 Luca Ferrari
2005-02-10 12:45 ` Adrian C.
2005-02-10 14:58 ` Thornton Prime
0 siblings, 2 replies; 3+ messages in thread
From: Luca Ferrari @ 2005-02-10 12:19 UTC (permalink / raw)
To: linux-admin
Hi,
in my internal network someone is using a kind of arp poisoning, since two (or
more) computers results _sometimes_ associated to the same MAC address. Since
I've got a linux firewall-proxy (iptables and squid) that limits the traffic
depending on the mac address, this is a problem for me. Is there a solution
to solve the problem?
Thanks,
Luca
--
Luca Ferrari,
fluca1978@infinito.it
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: arp poisoning?
2005-02-10 12:19 arp poisoning? Luca Ferrari
@ 2005-02-10 12:45 ` Adrian C.
2005-02-10 14:58 ` Thornton Prime
1 sibling, 0 replies; 3+ messages in thread
From: Adrian C. @ 2005-02-10 12:45 UTC (permalink / raw)
To: Luca Ferrari; +Cc: linux-admin
Might wanna look into this:
http://freshmeat.net/projects/ip-sentinel/
--Adrian.
On Thu, 10 Feb 2005 13:19:51 +0100, Luca Ferrari <fluca1978@infinito.it> wrote:
> Hi,
> in my internal network someone is using a kind of arp poisoning, since two (or
> more) computers results _sometimes_ associated to the same MAC address. Since
> I've got a linux firewall-proxy (iptables and squid) that limits the traffic
> depending on the mac address, this is a problem for me. Is there a solution
> to solve the problem?
>
> Thanks,
> Luca
> --
> Luca Ferrari,
> fluca1978@infinito.it
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: arp poisoning?
2005-02-10 12:19 arp poisoning? Luca Ferrari
2005-02-10 12:45 ` Adrian C.
@ 2005-02-10 14:58 ` Thornton Prime
1 sibling, 0 replies; 3+ messages in thread
From: Thornton Prime @ 2005-02-10 14:58 UTC (permalink / raw)
To: Luca Ferrari; +Cc: linux-admin
On Thu, 10 Feb 2005 13:19:51 +0100, Luca Ferrari <fluca1978@infinito.it> wrote:
> in my internal network someone is using a kind of arp poisoning, since two (or
> more) computers results _sometimes_ associated to the same MAC address. Since
> I've got a linux firewall-proxy (iptables and squid) that limits the traffic
> depending on the mac address, this is a problem for me. Is there a solution
> to solve the problem?
Someone else mentioned ip-sentinel. Arpwatch is also a useful tool.
If this is on your internal network, you are best off tracing down
which devices are conflicting and figuring out if this is intentional
or some sort of bug. Someone capable of arp poisoning on your internal
network might have done a lot more than suck bandwidth -- they can
launch a number of man-in-the-middle attacks.
thornton
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2005-02-10 14:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-02-10 12:19 arp poisoning? Luca Ferrari
2005-02-10 12:45 ` Adrian C.
2005-02-10 14:58 ` Thornton Prime
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).