Network Security – Defenses against arp spoofing
So, we’ve spent a couple articles talking about arp spoofing. It sounds really bad, it’s a frighteningly easy way to do a “mitm” or man in the middle attack and anyone using arp spoofing could capture ALL network traffic including passwords. There’s got to be an easy fix right? Um…. well. This is not something you’re going to want to read, but there aren’t a lot of good options. It’s possible to setup a static arp table. With a static arp table, a machine ( switch/router ) has a list of known good MAC addresses and which IP addresses they should match.
If you have a small number hardware on the network and there is little changing of hardware, AND you have static IP addresses this might be a good choice. For larger networks it might be too unwieldy to manage though. One approach would be to do a static arp entry for “important” machines. (Like the gateway?) So, this is likely not a reasonable approach for many. (Especially home/small business users.)
Another approach is to be creative with subnets and make sure that untrusted machines get put into a seperate subnet from “trusted” machines.
There is a program called arpwatch that can keep track of what arp/ip address pairings have been found on the network and will report new entries to the administrator. Unfortunately, this last item is not preventative, but will let you know if something odd is up. (Of course, depending on how you retrieve mail from the machine, IF the machine is arp poisoned, the attacker will likely know that the administrator is aware….)
Popularity: 1% [?]
Related Posts - Network Security guide for the home or small business network - Part 7 - Wireless Networking OK - the last couple of entries got into some heavy lifting and some real learning on your part. Learning about what software needs to run, what services are running, updating them to keep current on security patches. We even talked about securing services listening for outside connections and limiting......
- Network Security guide for the home or small business network - Part 16 - Learn about the enemy I remember I had a geography teacher once that was a former Marine and he said when he was growing up it was the height of the cold war and geography was interesting to him from a "know your enemy" point of view. That's a good concept to apply to......
- Network security - what does arp spoofing mean for wireless? So, if you haven't already had enough cause to tighten your wireless security.... we've been talking about arp poisoning (spoofing) and the basic conclusion is that IF an attacking machine is on the same subnet as your machine (same IP address range), they can "own" all traffic from you machine......
Related Websites - Lobster Elite Model 3 Tennis Ball Machine One of the best ways to practice tennis is to use a ball machine, but these can be expensive. If you have your own home court, or you play at a public court system where there isnât a ball machine on site, buying your own is an option that many......
- Hackers breach security giant RSA’s network An interesting article by Silicon Republic about the recent RSA breach. EMC’s security division RSA has revealed its own network has been breached by hackers who launched an ‘extremely sophisticated’ attack that may have compromised the company’s SecureID authentication service. In a note to customers, executive chairman Art Coviello said......
- Tennis Ball Machine Advantages If you are looking for ways for you to significantly improve your techniques in tennis, then one of the best things that you can possibly to do is to invest in a tennis machine or tennis ball machine. This is a truly ideal device for anyone that is interested in......
Similar Posts
- Network security – what does arp spoofing mean for wireless?
- Network Security – Arp spoofing
- Network security – how safe is your network? Looking at ARP
- Network Security – how should an open wireless access point be run beside a safe network?
- Network Security – Arp spoofing series