ARP protocol for TCP/IP stack reinforcement of Unix operating systems

ARP Protocol Analysis

Layer 3 of the OSI model is the data link layer, which provides a data transmission mechanism between network nodes. The important reason for this layer is that it is responsible for dividing data into frames for transmission. There are many insecure factors worth exploring on the data link layer, but the most important is the IP Address Resolution Protocol ARP ).

The Address Resolution Protocol ARP is used to convert IP addresses to MAC addresses. To avoid unnecessary ARP packet query, the operating system of each host maintains an ARP high-speed Cache ARP Cache, record the ing between IP addresses of other hosts on the same link and MAC addresses. ARP high-speed cache is usually dynamic. The cache can manually add static entries, which are refreshed by the system after a certain interval.

Although ARP is an efficient data link layer protocol, as a LAN protocol, it is built on mutual trust between hosts. Therefore, ARP has the following defects: ARP high-speed cache is dynamically updated at any time based on the received ARP Protocol package. ARP has no connection concept, and any host can respond even if there is no ARP request; the ARP Protocol does not have an authentication mechanism. As long as the received protocol package is valid, the host will unconditionally refresh the local ARP cache based on the content of the Protocol package, without checking the legitimacy of the Protocol package.

ARP Application

Therefore, attackers can send fake ARP packets to update the ARP cache on the attacked host at any time to perform Address Spoofing or DoS attacks. Adjust the ARP cleaning time. By buffering IP addresses with forged ARP entries, malicious users can experience resource depletion and performance reduction attacks.

 
 

  
  
AIX5  
  
  
 
  
  
#no -o arpt_killc=20 
  
  
 
  
  
FreeBSD 5-7  
  
  
 
  
  
#sysctl -w net.link.ether.inet.max_age=1200 
  
  
 
  
  
Solaris8-10  
  
  
 
  
  
#ndd -set /dev/arp arp_cleanup_interval 60000  
  
  
 
  
  
Linux2.4-2.6  
  
  
 
  
  
#sysctl -w net.link.ether.inet.max_age=1200 
 
 

Note: If the interval between ARP cache cleanup is set to be too large, a large network may not be allocated to an ip address (some hosts that are assigned an ip address are not opened or occupy the ip address). It must be too small, this caused a large number of broadcast storms.

The content of ARP attacks has been introduced to you. I hope you have mastered it. We will continue to introduce it to you in future articles. This article and previous articles mainly introduce how to enhance the TCP/IP stack of Unix family systems. In fact, it is very simple. By configuring command lines, you can protect or mitigate Unix-type servers from Network-level denial-of-service attacks, including SYN flood attacks, ICMP attacks, and SNMP attacks.

1. UNIX System Security Crisis assessment
2. Take targeted measures to ensure the security of Unix servers
3. Analysis of the inevitability of Unix host System Security Vulnerabilities
4. TCP/IP stack reinforcement for Unix operating systems-TCP protocol section
5. ARP protocol for TCP/IP stack reinforcement of Unix operating systems