3

I am currently studying about arp spoofing attack (mitm). Most common linux distributions seems to be by default exposed to these kind of attack. However, a simple solution seems to set gateway arp entry in static state.

Is there a way with NetworkManager (dispatcher.d) to automatically set a gateway arp entry in static state (or same effect)? Or there is a parameter to set in sysctl.conf avoid arp poisoning? Or maybe another way to achieve this?

2 Answers 2

1

Conceptually yes, pinning some MAC addresses is a possible solution (as per @daniel's answer above), but there's many drawbacks to it:

  • Whilst you can add static ARP entries, your attacker can still spoof the gateway and your MACs and both systems will parse the attackers' frames;
  • If your system is getting its L3 configuration via DHCP, the attacker can attack that to ensure you are using a different gateway, in which case pinning the MAC of the real gateway will make no difference;
  • You will struggle to maintain a list of static entries, since all systems will need configuring manually;
1
  • 1
    Spoof/poisoning is indeed the problem. Quite good answer +1 Commented Feb 19, 2018 at 18:03
0

I advise you to first test it with:

arp -s router_hostname router_ethernet_addr

where router_ethernet_addr is the MAC address (Ethernet or 802.11) address of your router. To check on your particular Linux distribution, read:

man arp

When this is OK, I suggest to reject any dynamical adding to your arp table with:

sysctl 'arp_accept=0'
sysctl 'drop_gratuitous_arp=1'

To check this sysntax, read:

man sysctl
man sysctl.conf

Then test to make a fake router reply within your network and check if its Ethernet (or 802.11) address is accepted or not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .