How to defend against ARP attacks in Linux system

This article mainly explains "how the Linux system protects against ARP attacks". The content in the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "how the Linux system protects against ARP attacks".

Administrator user login, open terminal input

1. # arp-a > / etc/ethers

Import ip and mac addresses into ethers

2 、 # vi / etc/ethers

To edit the file format, the contents of the ethers file must be deleted as follows and changed to the form ip mac

192.168.1.X XX:XX:XX:XX:XX

192.168.1.X XX:XX:XX:XX:XX

...

/ / notice that mac capitalizes, and there is no O, only zero, ip and mac spaces

3. # vi / etc/rc.d/rc.local / / Open and display / etc/rc.d/rc.local file, startup item file

# I / / Edit

/ / execute arp-f at startup to bind according to the content in / etc/ethers

Add the last line to the / etc/rc.d/rc/local file

Arp-f

ESC exits editing

: wq / / Save edits

4. # arp-f / / execute the saved binding

(gateway mac is not included in ethers, otherwise an error will be reported)

This can only prevent some arp attacks. If all the ip mac in the network is imported into the ethers file, it can effectively prevent arp attacks.

1. Nmap-sP 192.168.11.0 Universe 24

Scan, it turns out that my arp table contains the mac of all the machines in that network segment, and copy all the information to the / etc/ethers file.

2, 3, 4 ditto

Thank you for reading, the above is the content of "how the Linux system protects against ARP attacks". After the study of this article, I believe you have a deeper understanding of how the Linux system protects against ARP attacks, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!