Linux System VPS Binding gateway prevents ARP attacks

The general VPS Gateway is not changed, and the single suit also applies.

First, view the current gateway

Arp-a

SSH executes the above command to view the gateway host name, Gateway IP, Gateway MAC address and the corresponding network card, as shown below

Second, binding Gateway Mac

1) Binding

echo "198.52.103.193 00:d0:2b:d1:58:80" >/etc/ethers# yellow Part Please revise according to the facts. Format: Gateway IP (space) MAC address #www. 111cn.net

2) activation to make it effective

Arp-f/etc/ethers

SSH executes the above command so that it takes effect.

Third, check whether the entry into force

To execute the above command again, the following figure, if the end of the sentence is one more: "PERM", means that the manual binding is effective.

Four, the power-on automatic execution arp-f

#打开并显示/etc/rc.d/rc.local file, startup item file
Vi/etc/rc.d/rc.local
i# Editor
#启动的时候执行arp-F is bound by the content in/etc/ethers and the last line in the/etc/rc.d/rc/local file is added
Arp-f
#退出编辑
Esc
#保存编辑
: Wq
Arp-f//Execution of saved bindings

Add:

/* Use Arpspoof to protect against ARP attacks * *
#提供方案原创者: yk103, thank you!
Install Libnet First
Http://www.packetfactory.net/libnet/dist/libnet.tar.gz
Tar-xvzf libnet.tar.gz
CD libnet
./configure
Make
Make install

Install Arpoison
Http://www.arpoison.net/arpoison-0.6.tar.gz
Tar-xvzf arpoison-0.6.tar.gz
CD Arpoison
GCC Arpoison.c/usr/lib/libnet.a-o Arpoison
MV Arpoison/usr/sbin

Write arpdefend.sh scripts.
Code: #!/bin/sh
#arpDefend. Sh
#yk103
#网关mac地址
Gateway_mac=00:11:22:33:44:55
#目的mac地址
Dest_mac=ff:ff:ff:ff:ff:ff
#目的ip地址 (network segment broadcast address)
dest_ip=60.191.82.254

#本地网卡接口
Interface=eth0
# $INTERFACE MAC Address
My_mac=00:30:48:33:f0:ba
# $INTERFACE IP Address
my_ip=60.191.82.247

#在本机建立静态ip/mac entrance $DEST _ip--$GATEWAY _mac
Arp-s $DEST _ip $GATEWAY _mac

#发送arp reply to make $dest_ip update $my_ip MAC address is $my_mac
Arpoison-i $INTERFACE-D $DEST _ip-s $MY _ip-t $DEST _mac-r $MY _mac 1>/dev/null