I'm running Linux and I know my gateway will always be 192.168.1.254 with MAC address aa:aa:aa:aa:aa:aa.
Is there any way I can instruct my machine to only ever use this MAC address for the gateway and ignore all ARP responses for this IP address?
-
3Ignoring all ARP packets to prevent ARP poisoning is like amputating your head to prevent tongue cancer.– HopelessN00bMar 13, 2013 at 14:59
-
that will not prevent ARP spoofing altogether.– MDMoore313Mar 13, 2013 at 15:00
-
@HopelessN00b He doesn't want to cut his head, but his tongue. He only wants to ignore ARP packets for the tongue. Also, he seems to have no use for the tongue at all.– LukasMar 13, 2013 at 15:51
-
@Lukas In the first 2 question revisions, there was an explicit question about ignoring "all ARP packets," hence the comment about cranial amputation.– HopelessN00bMar 13, 2013 at 18:58
Add a comment
|
2 Answers
You can use arp to control the ARP tables.
arp -s 192.168.1.254 aa:aa:aa:aa:aa:aa
will statically map the IP to the MAC, bypassing ARP, and should do the trick.
-
-
@user164384: This is exactly what you want. In a highly locked down environment you want to use static ARP entries for any kind of infrastructure equipment. Be aware that this won't prevent spoofing, but it goes a long way towards mitigating classic ARP poisoning MitM attacks. Mar 13, 2013 at 15:39
ARP has to do with ethernet<->ip mapping, not default gateway setting.
After you set up static network address/gateway (link) you can add a static arp entry for your gateway (link)
arp -i <your interface> -s <ip.of.the.gateway> <mac:of:the:gateway>
arp -i eth0 -s 192.168.1.254 aa:aa:aa:aa:aa:aa
-
We really do prefer that answers have content, not pointers to content. This may theoretically answer the question however, it would be preferable to include the essential parts of the answer here, and provide the link for reference.– Chris SMar 13, 2013 at 15:44