Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 15 Jul 2002 10:26:41 -0700
From:      Lars Eggert <larse@ISI.EDU>
To:        net@freebsd.org, Joe Touch <touch@ISI.EDU>, Yu-Shun Wang <yushunwa@ISI.EDU>
Subject:   Denial-of-service through ARP snooping
Message-ID:  <3D3305D1.5050103@isi.edu>
next in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Hi,

we've just stumbled over an interesting denial-of-service case at IETF. 
I was playing with a custom startup script to auto-configure local 
interfaces, part of which sent out an ARP request "borrowing" the IP 
address of the gateway as source address (e.g. "who-has X tell X").

It seems that most/all BSDs do ARP snooping, and will happily add the 
apparent "new" MAC address of the gateway to their ARP table, possibly 
flushing the existing one of the default gateway. This of course causes 
everybody's packets to fall on the floor until the fake ARP entry times 
out. (RFC826 seems to imply that snooping is allowed, the "packet 
reception" section doesn't seem to limit *how* packets are received.)

Maybe ARP entries should only be updated when replies are received in 
response to locally originated requests? Initial latency might be a bit 
higher, since the ARP table won't be pre-loaded, but it will add some 
protection against this particular DOS attack.

Lars
-- 
Lars Eggert <larse@isi.edu>           USC Information Sciences Institute

[-- Attachment #2 --]
0	*H
010	+0	*H
00G0
	*H
010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.300
010824164000Z
020824164000Z0T10
UEggert1
0U*Lars10ULars Eggert10	*H
	
larse@isi.edu00
	*H
0|\Pw v~~FDooӦA\-	 Cˀ4.)&{肋,z(ܷر߈T7_'txGH^tt/ҹB8%t<#ֲNV0T0*+e!000L2uMyffBNUbNJJcdZ2s0U0
larse@isi.edu0U00
	*H
aJPMՒ]cѭC+kS+wZ1gY",YT41
j6:~℩D~Kؚ‡l=u(ՎM?cF7@}T00G0
	*H
010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.300
010824164000Z
020824164000Z0T10
UEggert1
0U*Lars10ULars Eggert10	*H
	
larse@isi.edu00
	*H
0|\Pw v~~FDooӦA\-	 Cˀ4.)&{肋,z(ܷر߈T7_'txGH^tt/ҹB8%t<#ֲNV0T0*+e!000L2uMyffBNUbNJJcdZ2s0U0
larse@isi.edu0U00
	*H
aJPMՒ]cѭC+kS+wZ1gY",YT41
j6:~℩D~Kؚ‡l=u(ՎM?cF7@}T080fErtcvE.0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
000830000000Z
040827235959Z010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.3000
	*H
032c	%E>nx'gڈD)c5*mp<ܮto034qmOe
KaU5u'rװ|CBPQ<9TIf-	kiN0L0)U"0 010UPrivateLabel1-2970U00U0
	*H
1KG]qSl]y=&b""I'{9$
*8PUl
LGlX1B	li+@]jy.%݊
Z<D&iHΥbb100010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.30G0	+a0	*H
	1	*H
0	*H
	1
020715172642Z0#	*H
	1~HyhHu4@)P0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0*H
	1010	UZA10UWestern Cape10U	Cape Town10
U
Thawte10UCertificate Services1(0&UPersonal Freemail RSA 2000.8.30G0
	*H
('hcWJKu>͝w8_m7=a&ў[ɍ2yK`F-Ġ4glYnL$p-N1"ڥjOÚq5'W!2c6

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D3305D1.5050103>