Defense Against arp in Linux

Defense arp in Linux-Linux Enterprise Application-Linux server application information. For details, refer to the following section. 1. How to obtain the MAC addresses of all machines under the same network segment

Machine viruses are detected in the data center, arp packets are sent. Although arpspoof can solve the problem, you can also find the mac address of the computer with viruses. However, when the equipment in the data center is insufficient, it is difficult to find the IP address corresponding to the mac address. Then we can use arping to send a packet to the machine under the subnet through a loop, so that we can view the corresponding mac cache under arp, and then get

IP address.

#! /Bin/sh
# Thanks to the author Wu Hongsheng
For (I = 1; I <254; I ++ ))
Do
Arping-I eth0 60.191.82. $ I-c 1
Done
Arp-a> mac_table
After the script is run, view the mac_table generated in the current directory.
# Arp-a: Find the MAC address of the gateway when you are poisoned, and record the corresponding machine in mac_table. Then you can find out that machine is infected with the ARP virus.

2. # yk103, the original solution provider. Thank you!
Install libnet first
Http://www.packetfactory.net/libnet/dist/libnet.tar.gz
Tar-xvzf libnet.tar.gz
Cd libnet
./Configure
Make
Make install

Install arpoison
Http://www.arpoison.net/arpoison-0.6.tar.gz
Tar-xvzf arpoison-0.6.tar.gz
Cd arpoison
Gcc arpoison. c/usr/lib/libnet. a-o arpoison
Mv arpoison/usr/sbin

Write the arpDefend. sh script.

#! Bash
# ArpDefend. sh
# Yk103
# Gateway mac address
GATEWAY_MAC = 00: 11: BB: A5: D2: 40
# Target mac address
DEST_MAC = ff: ff
# Destination IP address (CIDR Block broadcast address)
DEST_IP = 60.191.82.254

# Local Nic Interface
INTERFACE = eth0
# $ INTERFACE mac address
MY_MAC = 00: 30: 48: 33: F0: BA
# $ Interface ip Address
MY_IP = 60.191.82.247

# Create a static IP/mac entry on the local machine $ DEST_IP -- $ GATEWAY_MAC
Arp-s $ DEST_IP $ GATEWAY_MAC

# Send arp reply to update $ DEST_IP to $ MY_IP. the mac address of $ MY_IP is $ MY_MAC.
Arpoison-I $ INTERFACE-d $ DEST_IP-s $ MY_IP-t $ DEST_MAC-r $ MY_MAC 1>/dev/null &