On-line has many seeks help the ARP virus guard means that actually the ARP deceit principle is simple, what uses is ARP agreement one “the flaw”, free ARP achieves deceives the main engine above gateway the arp table item.
Free ARP at that time designed was for 2 functions:
1.IP address collision detection
the 2.ARP clause renews automatically, renews the gateway.
the arp deceit is uses inside this's second, the attack main engine transmits arp to renew, the clause ip address is a gateway, but mac address one item, is actually not a gateway, when other main engines accept, according to the arp agreement rule, a newer more reliable principle, will achieve the deceit the goal. Although arp is not tcp/ip agreement bunch of one, but in view of the fact that ethernet's big line of its road, therefore gives up the dynamic ARP agreement, the use manual way comes to make the arp mapping, probably not big reality (exceptional cases exception).
Under the introduction under the cisco network environment solves this question mentality:
Actually inside this used 2 technologies: dhcp snooping and ARP inspection
.dhcp snooping
DHCP the Snooping technology is the DHCP security feature, through establishes and maintains the DHCP information which DHCP the Snooping binding table filtration cannot be trusted, these information are refer to from do not trust the region the DHCP information. DHCP the Snooping binding table contains does not trust the region the user MAC address, the IP address, to rent information and so on time, VLAN-ID connection.
After the switchboard has opened DHCP-Snooping, will carry on the interception to the DHCP text, and may from the receive to DHCP Request or DHCP in the Ack text will withdraw and record the IP address and the MAC address message. Moreover, the DHCP-Snooping permission establishes some physical port to trust the port or does not trust the port. Trusts the port to be possible to receive and to retransmit DHCP normally the Offer text, but does not trust DHCP which the port will receive Offer text discarding. Thus, may complete the switchboard to pretend DHCP Server the shielding effect, guaranteed that the client side gains the IP address from legitimate DHCP Server.
Function:
the 1.dhcp-snooping leading role is isolation illegal dhcp server, must trusts the port through the disposition.
2. establishes and maintains dhcp-snooping the binding table, this table one is through dhcp ack package of ip and the mac address production; second, may assign manually.
This table is following DAI (dynamic arp inspect) and IP Source the Guard foundation. These two kind of similar technologies, are determine ip or the mac address through this table to be whether legitimate, limits the user to connect the network.
Disposition:
switch (config) #ip dhcp snooping
switch (config) #ip dhcp snooping vlan 10
switch (config-if) #ip dhcp snooping limit rate 10
the/*dhcp package of repeater speed, surpasses on the connection on shutdown, tacitly approves does not limit
switch (config-if) #ip dhcp snooping trust
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> network management
> Content
Category: Home
> network management