Linux view static ARP address binding or ARP attack IP address

Description
Computer room to do network transformation, need to replace the original internal and external network switch. The server is just the few cabinets that are replacing the switch. Replace the front room to ask us if we have to do mac binding. This binding mainly refers to the server has no static MAC address for the specified gateway. Because the switch is to be replaced, the LAN transfer data is transmitted through the Mac. If there is a binding, the server can not learn the new switch MAC address, the data is still sent to the old Gateway MAC address, so the network is not through!
Therefore, the engine room replacement switch to confirm our server has no binding gateway MAC address

Realize:
First, do two comparative trials:

The code is as follows	Copy Code
# ARP-A ? (192.168.8.241) at 00:15:58:a2:13:d0 [ether] on eth0 ? (192.168.8.1) at 00:15:c5:e1:d1:58 [ether] on eth0 # arp-s 192.168.8.1 00:15:c5:e1:d1:58 # ARP-A ? (192.168.8.241) at 00:15:58:a2:13:d0 [ether] on eth0 ? (192.168.8.1) at 00:15:c5:e1:d1:58 [ether] PERM on eth0

Did you find it? One more perm!!. That's the newly added static Mac binding.

Or

The code is as follows	Copy Code
# Cat/proc/net/arp IP address HW-type Flags HW address Mask Device 192.168.8.241 0x1 0x2 00:15:58:a2:13:d0 * eth0 192.168.8.1 0x1 0x6 00:15:c5:e1:d1:58 * eth0 # arp-s 192.168.8.241 00:15:58:a2:13:d0 # Cat/proc/net/arp IP address HW-type Flags HW address Mask Device 192.168.8.241 0x1 0x6 00:15:58:a2:13:d0 * eth0 192.168.8.1 0x1 0x6 00:15:c5:e1:d1:58 * eth0

Did you find it? The flags have changed! So we can find the ARP static binding address in two ways:

The code is as follows	Copy Code
Arp-a | grep Perm or Cat/proc/net/arp | grep 0x6

, but it is recommended to use the latter more quickly.