4 ms·

I've been wanting to implement a dynamic ARP filter (DHCP snooping + ARP filtering) for ages now, but arptables/ebtables just didn't cut it. Hopefully this will

I've been wanting to implement a dynamic ARP filter (DHCP snooping + ARP filtering) for ages now, but arptables/ebtables just didn't cut it. Hopefully this will be easier/viable now. Because I still don't think ArpON sniffs DHCP leases for its mapping (it intercepts and replays ARP requests or something) and it doesn't filter rogue DHCP servers. I'm just amazed ARP spoofing/ARP cache poisoning is still a viable attack vector on home networks in 2014.

adekok 13y ago
Please see the "master" branch of FreeRADIUS. https://github.com/FreeRADIUS/freeradius-server/ https://github.com/FreeRADIUS/freeradius-server/ It can accept both DHCP and ARP protocols, and will decode them into attribute-value pairs. Those can then be referenced in a policy language, and stored to / read from a database. I'm the author. :) It's no longer just a RADIUS server. I've been looking for a DHCP / ARP checker for a while, and couldn't find anything useful. Rather than writing something from scratch, I decided it was easier to just add ~2K LoC to FreeRADIUS. I could then leverage the policy language and database integration, so I didn't have to re-write all of that, either.
- esbranson 13y ago
  Excellent. :) I will look into this. I am targeting embedded devices on OpenWRT, which means it needs to be as simple and small as possible, so I hope the code is tight. But on the other hand, I would prefer to not reinvent the wheel.
  - adekok 13y ago
    The code is tiny. It already runs on OpenWRT, so there's no issue there.
smutticus 13y ago
You need to implement DHCP Snooping at Layer 2 for it to really work, and these days I think all major switch vendors support it. Unless you're building a Linux L2 switch I don't see why you would want to implement DHCP Snooping.
- esbranson 13y ago
  You need DHCP snooping for proper ARP reply filtering. It is the cleanest way of determining MAC address<->IP address mappings.

adekok 13y ago

Please see the "master" branch of FreeRADIUS. https://github.com/FreeRADIUS/freeradius-server/ https://github.com/FreeRADIUS/freeradius-server/ It can accept both DHCP and ARP protocols, and will decode them into attribute-value pairs. Those can then be referenced in a policy language, and stored to / read from a database. I'm the author. :) It's no longer just a RADIUS server. I've been looking for a DHCP / ARP checker for a while, and couldn't find anything useful. Rather than writing something from scratch, I decided it was easier to just add ~2K LoC to FreeRADIUS. I could then leverage the policy language and database integration, so I didn't have to re-write all of that, either.

esbranson 13y ago
Excellent. :) I will look into this. I am targeting embedded devices on OpenWRT, which means it needs to be as simple and small as possible, so I hope the code is tight. But on the other hand, I would prefer to not reinvent the wheel.
- adekok 13y ago
  The code is tiny. It already runs on OpenWRT, so there's no issue there.

smutticus 13y ago

You need to implement DHCP Snooping at Layer 2 for it to really work, and these days I think all major switch vendors support it. Unless you're building a Linux L2 switch I don't see why you would want to implement DHCP Snooping.

esbranson 13y ago
You need DHCP snooping for proper ARP reply filtering. It is the cleanest way of determining MAC address<->IP address mappings.