lkml.org 
[lkml]   [1999]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Arp expire/timeout 2.1.132/2.2pre1
On Sat, Jan 02, 1999 at 09:02:03AM -0800, David S. Miller wrote:
> Date: Sat, 2 Jan 1999 17:32:19 +0100
> From: Florian Lohoff <flo@rfc822.org>
>
> Wouldnt this work when:
> - Restart neighbour entry expiry time on receive of an packet which matches
> the correct IP/MAC address pair ?
>
> This makes ARP spoofing really easy and thus allows easy denial of
> service attacks.

Maybe i am blind but i cant see that point ? If an entry in the
Arp cache does NOT exist we dont accept it by this behaviour.
So where is the possibility of arp spoofing here ?

Only if An Arp Cache Entry exists, and the packet matches the Entry
coming in matches correcty we restart the timer.

Only problem i might see is a performance loss as for every packet
we have to search the Arp table ... Ok - forget it - just a silly thought.

Flo
--
Florian Lohoff flo@rfc822.org +49-5241-470566
Good, Fast, Cheap: Pick any two (you can't have all three). (RFC 1925)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.100 / U:0.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site