如何隐藏arp地址？(页 1) - Linux/Unix系统安全 - Linux伊甸园论坛

blackspace 发表于 2004-2-20 14:33

如何隐藏arp地址？

如何当别人ARP我的地址时候，不理它？不告诉它我的地址信息？

blackspace 发表于 2004-2-20 14:47

想通了，不行，:D ，就上不了网络了

lost33 发表于 2004-2-23 09:34

我觉得可以有选择的回复，比如是我的DHCP，我就回答，是一个网段的其他东西就不搭理它，这样是不是就可以避免arp嗅探了？

blackspace，有兴趣继续么？

blackspace 发表于 2004-2-23 10:13

2个结果献上：
有时侯更改MAC是更好的选择，
可以禁止arp，(这个不如剪断一根网线)
这两个都可以用ifconfig来搞。

有选择的回复，继续研究！

blackspace 发表于 2004-2-23 10:21

关键iptables好象不管arp的事情。

-p, --protocol [!] protocol
            The  protocol of the rule or of the packet to check.  The speci-
            fied protocol can be one of tcp, udp, icmp, or all, or it can be
            a  numeric  value, representing one of these protocols or a dif-
            ferent  one. A  protocol  name  from  /etc/protocols  is  also
            allowed. A  "!" argument before the protocol inverts the test.
            The number zero is equivalent to all.  Protocol all  will  match
            with  all  protocols and is taken as default when this option is
            omitted.

blackspace 发表于 2004-2-23 10:23

apple linux # iptables -A INPUT -p arp -j LOG
iptables v1.2.9: unknown protocol `arp' specified
Try `iptables -h' or 'iptables --help' for more information.

lost33 发表于 2004-2-24 10:03

看来你需要对网络协议深入了解一下下哈，
arp和 tcp/ip 不是一个层的，arp比tcp更底层。
所以，iptables不管，
如果是udp ，他就管，因为是一个层的。

我说的是，自己编一个程序，不知道 flag 大大能不能搞一个？？

blackspace 发表于 2004-2-24 10:51

blackspace 发表于 2004-2-24 11:00

[COLOR=darkblue]
Why does arptables have 2 chains on a 2.4 kernel and 3 chains on a 2.6 kernel?
[/COLOR]
The 2.4 kernel doesn't have the arptables FORWARD chain as 2.4 kernels can't filter bridged ARP traffic.

[COLOR=darkblue]
When is the bridged ARP traffic seen by arptables?
[/COLOR]
The artables FORWARD chain sees all ARP packets that are being bridged, it sees no other traffic.

[COLOR=darkblue]
What about ARP packets that arrive through a bridge port and are delivered to the bridge's local ARP stack?
[/COLOR]
They are seen in the arptables INPUT chain and have as input device the logical bridge device, unless you broute them using ebtables. Brouted packets will have the physical bridge port as input device.

[COLOR=darkblue]
What about locally generated ARP packets that leave the bridge through a logical bridge device?
[/COLOR]
They are seen in the arptables OUTPUT chain and have as output device the logical bridge device.

blackspace 发表于 2004-2-24 11:14

apple net # cat /proc/net/arp_tables_names
filter

就是找不到arptables工具。

blackspace 发表于 2004-2-24 11:38

lost33老大:
看样子，任务完成了。

apple sbin # ./arptables -L
Chain INPUT (policy ACCEPT)

Chain OUTPUT (policy ACCEPT)

Chain FORWARD (policy ACCEPT)

cnlgw 发表于 2004-3-24 14:43

除非同过交换机，在上成隔离，否则难作

春暖花开 发表于 2004-5-22 20:20

[color=blue]

　　arptables这个工具哪里有？
[/color]

blackspace 发表于 2004-5-24 20:12

google

yocaee 发表于 2004-6-8 08:18

求救!!

各路大侠,我想求救!!
在我启动LINUX时,出现了一对话框:I could not start the X server(your graphical environment)due to some internal error.

irror 发表于 2005-7-19 14:44

在switch 上划 vlan 也可以吧!

Roc.Ken 发表于 2005-8-20 12:03

arp 的隐藏或者是欺骗在 linux cluster 中是一个关键的技术，在linux 的各个版本的内核（2.0.*-2.6.*）中都有此功能的实现,

[url]http://www.linuxvirtualserver.org/docs/arp.html[/url]

页: [1]

Linux伊甸园论坛's Archiver

如何隐藏arp地址？

求救!!