Arp linux static entry

Add arp entry Linux

Read the question carefully in order to propose a solution, please I need to add permanent arp entry in Linux somehow. The problem is: if I add an entry via shell, or via sockets, it always gets flag 0x6. Even if I use the code posted downhere, where I specify the flag, it remains the same, 0x6. I found this information about 0x6 flag:

Notice the ARP flag of «0x6». The ASIC ARP entry with flag 0x6 is MAC-cache related entry. It is caused by arp lookup failure when installing the session. The session will try to use the source MAC address of incoming packet, but it is not necessary for using this mac address. We can get the MAC address when the reply packet arrives by sending an ARP packet to the source host.

So anytime I add any arp entry, then I ping the same ip address, it always results in ARP request broadcast. The question is, is there a way how to add a permanent ARP entry with proper flag? So I add an entry, and in case of any comunication afterwards, there wont be any ARP broadcast? Btw, to get into what I am up to: I am sending a broadcast(L3) from PC1 containing PC1’s IP and MAC, PC2 gets the packet and add addresses them into ARP table and establish TCP session, but always first run ARP broadcast. via shell:

char *mac_ntoa(unsigned char *ptr) < static char address[30]; sprintf(address, "%02X:%02X:%02X:%02X:%02X:%02X", ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]); return(address); >/* End of mac_ntoa */ int mac_aton(char *addr, unsigned char *ptr) < int i, v[6]; if((i = sscanf(addr, "%x:%x:%x:%x:%x:%x", &v[0], &v[1], &v[2], &v[3], &v[4], &v[5])) !=6)< fprintf(stderr, "arp: invalid Ethernet address '%s'\n", addr); return(1); >/* End of If*/ for(i = 0; i < 6; i++)< ptr[i] = v[i]; >/* End of For */ return(0); > int main(int argc, char* argv[]) < if(argc < 3 || argc >4) < fprintf(stderr,"usage: %s  [temp|pub|perm|trail]\n", argv[0]); fprintf(stderr, "default: temp.\n"); exit(-1); > /* End of If */ int s, flags; char *host = argv[1]; struct arpreq req; struct hostent *hp; struct sockaddr_in *sin; bzero((caddr_t)&req, sizeof(req)); /* caddr_t is not really needed. */ sin = (struct sockaddr_in *)&req.arp_pa; sin->sin_family = AF_INET; sin->sin_addr.s_addr = inet_addr(host); if(sin->sin_addr.s_addr ==-1) < if(!(hp = gethostbyname(host)))< fprintf(stderr, "arp: %s ", host); herror((char *)NULL); return(-1); >/* End of If */ bcopy((char *)hp->h_addr, (char *)&sin->sin_addr, sizeof(sin->sin_addr)); > /* End of If */ if(mac_aton(argv[2], req.arp_ha.sa_data)) < /* If address is valid. */ return(-1); >argc -=2; argv +=2; flags = ATF_PERM | ATF_COM; while(argc-- > 0) < if(!(strncmp(argv[0], "temp", 4)))< flags &= ~ATF_PERM; >else if(!(strncmp(argv[0], "pub", 3))) < flags |= ATF_PUBL; >else if(!(strncmp(argv[0], "trail", 5))) < flags |= ATF_USETRAILERS; >else if(!(strncmp(argv[0], "dontpub", 7))) < /* Not working yet */ flags |= ATF_DONTPUB; >else if(!(strncmp(argv[0], "perm", 4))) < flags = ATF_PERM; >else < flags &= ~ATF_PERM; >/* End of Else*/ argv++; >/* End of While */ req.arp_flags = flags; /* Finally, asign the flags to the structure */ strcpy(req.arp_dev, "eth0"); /* Asign the device. */ if((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)< perror("socket() failed."); exit(-1); >/* End of If */ if(ioctl(s, SIOCSARP, (caddr_t)&req) <0)< /* caddr_t not really needed. */ perror(host); exit(-1); >/* End of If */ printf("ARP cache entry successfully added.\n"); close(s); return(0); > 

Источник

Set up static ARP entry

This article describes how to create a static ARP entry on Linux and Windows. Static ARP entries for important network components in the same Layer 2 segment provide some protection against ARP spoofing.

Ubuntu / Debian

In the following example we assume a gateway with the IP address 192.0.2.1 and the MAC address 00: XX: 0C: XX: DD: C1. The network interface used is eth0.

To create a static entry for this gateway, a file must be /etc/network/if-up.d/ created in. This must be created as root user.

/etc/network/if-up.d/add-my-static-arp

#! / Bin / sh arp -i eth0 -s 192.0.2.1 00: XX: 0C: XX: DD: C1

After that the executable bit has to be set for this file.

chmod + x /etc/network/if-up.d/add-my-static-arp

ifup The static entry is active from the next network interface.

Windows

In the following example we assume a gateway with the IP address 192.0.2.1 and the MAC address 00: XX: 0C: XX: DD: C1. The network interface is “Local Area Connection”.

In Windows Server 2008, the tool can be used netsh for configuration. This keeps the entries even after a reboot.

To do this, start the command line and log in as administrator:

runas / user: Administrator netsh netsh> interface netsh interface> ipv4 netsh interface ipv4> add neighbors "Local Area Connection" "192.0.2.1" "00-XX-0C-XX-DD-C1" store = persistent netsh interface ipv4> show neighbors Interface 1: Loopback Pseudo-Interface 1 Internet Address Physical Address Type -------------------------------------------- ------ ----------- ----------- 224.0.0.22 Permanent Interface 11: Local Area Connection Internet Address Physical Address Type -------------------------------------------- ------ ----------- ----------- 192.0.2.1 00-xx-0c-xx-dd-c1 Permanent .

Share this:

Источник

How to add or remove a static ARP entry on Linux

ARP (short for «Address Resolution Protocol») is a network protocol used to map an IP network address to a corresponding hardware MAC address. When host X wants to communicate host Y , X first broadcasts an ARP request on its local network to obtain Y ‘s MAC address. Once X receives ARP reply containing Y ‘s MAC address, X uses the information to construct Ethernet frames destined for Y .

The IP/MAC address mapping information so obtained is cached in local ARP table, so that ARP query process can be omitted subsequently.

Problems can arise when for whatever reason, host X does not receive ARP replies for a destination host Y with which it wishes to communicate. In other cases, ARP replies come in, but contain a MAC address associated with an incorrect host Z . Such corrupted ARP replies will result in traffic hijacking, where traffic that should have been sent to Y ends up arriving at host Z .

When dealing with these kinds of ARP-induced abnormal situations, it’s useful to be able to add static ARP entries manually on locally cached ARP table. When a MAC address of a destination host Y is found in local ARP table, there is no need to send out ARP requests.

Add a Static ARP Entry to Local ARP Table

$ sudo arp -s 10.0.0.2 00:0c:29:c0:94:bf

The above commands tells local ARP table that the host with IP address 10.0.0.2 has MAC address 00:0c:29:c0:94:bf . Once you have configured a static ARP entry, you can verify that.

? (192.168.10.47) at e0:db:55:ce:13:f1 [ether] on eth0 ? (192.168.10.1) at 00:e0:b1:cb:07:30 [ether] on eth0 ? (10.0.0.2) at 00:0c:29:c0:94:bf [ether] PERM on eth1 

As you can see above, the statically configured ARP entry correctly shows up, marked as PERM in the ARP table.

Delete a Static ARP Entry from Local ARP Table

$ arp -a -n ? (135.112.29.47) at e0:db:55:ce:13:f1 [ether] on eth0 ? (135.112.29.1) at 00:e0:b1:cb:07:30 [ether] on eth0 ? (10.0.0.2) at on eth1

Add Static ARP Entries Permanently on Linux

Note that any ARP entry added by arp command at run time like above does not remain persistently across reboots. In order to add a static ARP entry permanently, what you can do is to load ARP entries from an external file automatically when a network interface is up. For that, first create a file that contains static ARP entries.

00:0c:29:c0:94:bf 10.0.0.2 00:0c:59:44:f0:a0 10.0.0.5 . . . .

The arp command allows you to load any external file using -f option.

Now you need to set the above command to be run automatically when a given network interface (e.g., eth0 ) is up. There are distribution-specific ways to run a startup command for network interfaces. Following are distribution-specific examples.

Here I assume that you are not using Network Manager on your Linux system. So if you are using Network Manager, you will have to disable it first.

On Ubuntu, Debian or Mint, add the following entry in /etc/network/interfaces :

iface wlan0 inet dhcp . . . post-up arp -f /etc/ethers

On CentOS, RHEL or Fedora, create the following executable script, as described in this tutorial:

#!/bin/sh if [[ "$1" == "eth0" ]] then arp -f /etc/ethers else #DO_NOTHING fi

Make the script executable:

$ sudo chmod +x /sbin/ifup-local

Support Xmodulo

This website is made possible by minimal ads and your gracious donation via PayPal or credit card

Please note that this article is published by Xmodulo.com under a Creative Commons Attribution-ShareAlike 3.0 Unported License. If you would like to use the whole or any part of this article, you need to cite this web page at Xmodulo.com as the original source.

Источник

Network Security Hacks by

Get full access to Network Security Hacks and 60K+ other titles, with a free 10-day trial of O’Reilly.

There are also live events, courses curated by job role, and more.

Create a Static ARP Table

Use static ARP table entries to combat spoofing and other nefarious activities .

As discussed in [Hack #31] , a lot of bad things can happen if someone successfully poisons the ARP table of a machine on your network. The previous hack discussed how to monitor for this behavior, but how do we prevent the effects of someone attempting to poison an ARP table?

One way to prevent the ill effects of this behavior is to create static ARP table entries for all of the devices on your local network segment. When this is done, the kernel will ignore all ARP responses for the specific IP address used in the entry and use the specified MAC address instead.

To do this, you can use the arp command, which allows you to directly manipulate the kernel’s ARP table entries. To add a single static ARP table entry, run this:

arp -s ipaddr macaddr

If you know that the MAC address that corresponds to 192.168.0.65 is 00:50:BA:85:85:CA , you could add a static ARP entry for it like this:

# arp -s 192.168.0.65 00:50:ba:85:85:ca

For more than a few entries, this can be a time-consuming process. To be fully effective, you must add an entry for each device on your network on every host that allows you to create static ARP table entries.

Luckily, most versions of the arp command can take a file as input and use it to create static ARP table entries. Under Linux, this is done with the -f command-line switch. Now all you need to do is generate a file containing the MAC and IP address pairings, .

Get Network Security Hacks now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Источник