Cloudstack virtual Machine Arp-a when the gateway's MAC address is incomplete

Locating ARP attack source and defense methods

Active positioning mode: Because all ARP attack source will have its characteristics-the network card will be in promiscuous mode, can be arpkiller such a tool to scan the network of which machine network card is in promiscuous mode, so that the machine may be "culprit."

Callout: The network card can be placed in a mode called promiscuous mode (promiscuous), in which the network card working in this mode can receive everything through its data, regardless of the actual data destination address is not it. This is actually the basic principle of sniffer work: let the network card receive all the data it can receive.

Passive positioning mode: When an ARP attack occurs on the LAN, view the contents of the switch's dynamic ARP table, determine the MAC address of the attack source, or deploy the sniffer tool in the local network to locate the Mac of the ARP attack source.
You can also ping the gateway IP directly, after completing the ping, use Arp–a to view the MAC address of the gateway IP, this MAC address should be a spoofed Mac.

3) by querying the Ip--mac correspondence table, the IP address of the "000d870d585f" Virus host is "192.168.16.223".
With this method, we can quickly find the source of the virus and confirm its mac--〉 machine name and IP address.
2. Defense methods
A. Use a three-layer switch that can defend against ARP attack, bind Port-MAC-IP, limit ARP traffic, detect and automatically block ARP attack port in time, reasonably divide vlan, completely stop stealing IP, MAC address, eliminate ARP attack.
B. For networks that frequently outbreak viruses, Internet access control is used to restrict users ' access to the network. This type of ARP attack program is generally downloaded from the Internet to the user terminal, if the user can enhance the access control of the Internet, it can greatly reduce the occurrence of this problem.
C. When an ARP attack occurs, the source of the virus attack is found in time

Cloudstack virtual Machine Arp-a when the gateway's MAC address is incomplete