arpwatch and counter action

saavik · 05-21-2007, 02:20 AM

Hello!

I use arpwatch to find new (unknown) pc`s in our firm network.

Sometime funny externel supporters like to connect their notebooks to our network an arpwatch notices me of that.

Here my question:

What counter actions can I append to arpwatch and how ?

Isn`t there a possibility to send disconnect ip packages or something like that to disconnect the client from the network ?

btw. we also use dhcp.

thanks

saavik · 05-21-2007, 03:09 AM

OK!

I found something called arpalert but I would like to use arpwatch.

It must be possible as

http://www.wh-netz.de/knowledgebase/ArpWatch

says it works.

gloomy · 05-29-2007, 02:19 PM

I am not familiar with arpwatch, but presumably for the "possibility to send disconnect ip packages or something like that to disconnect the client from the network" you need filtering capabilities at the kernel level. Arptables can do that.[1]

[1] http://ebtables.sourceforge.net/

troybtj · 05-29-2007, 09:41 PM

If you are running a managed switch you could lock the port the new MAC is on, or better yet, lock all ports not in use. Same for hubs, only enable ports that you know are connected.

If the new MAC is because of a client using a portable hub to split a switched connection, all you can really do is shut down the port as close to the client as possible (i.e. not 10 unmanaged hubs), then wait for the help desk to forward the call to you.

saavik · 05-30-2007, 01:17 AM

As we use really mixed stuff of switches and hubs i am not able to turn off ports (which also would not help if somebody uses a patched port) and can not bind the macs to the ports.

but thanks anyway.