As enscripted by Daniel O'Callaghan: > > Does the arp cache really reflect the MAC address of the arriving > packets, or does it only contain the responses to ARP requests? The ARP cache is a "one-to-one" relationship table of ip addresses to MAC (ethernet) addresses FOR MACHINES THAT ARE ON THE SAME ETHERNET. That is to say, you may only find MAC addresses in the arp cache for machines that your machine can converse directly with via the ethernet. Any machines that are one or more router (not bridge) hops away will never show up in your ARP cache (barring proxy arp). > > If the latter, then consider: > > Since this week it has been demonstrated that it is not necessary for a > reply packet to reach the spoofer, it is not necessary for a spoofing > machine to respond to arp requests. But in real life, the spoofing machine would never be requested to respond to arp anyway, because in real life the spoofer should be on the other side of your firewall router. If the spoofer and spoofee are on the same ether- net then there are serious internal problems that go beyond the scope of firewalls!! > Take it a step further... mount a denial of service attack against the > machine being spoofed, then forge its ethernet address on outbound > packets, and listen in promiscuous mode for the inbound. In wide area networks (such as the internet), there are no "ethernet addresses" in outbound packets. In WAN's routers route IP packets, not ethernet packets. The ethernet encpasulation is stripped off the IP packet and replaced by some other encapsulation. > > Scarey! > > That said, the tcpwrapper MAC address mods have been on my do list for a > while. It will add to your armour but will not be the be-all and end-all. It won't do much. The thing to keep in mind is that the "ethernet" portion of the packet (MAC addresses and the like) are removed and added to IP packets as the packets move to and from ethernet media networks. The ethernet encap- sulation you see on a packet in your local net will be different than the encpasulation on the net from which the packet originated, because your router adds the ethernet encapsualtion when it wants to send the packet to a machine in your local net. Further, the originating MAC address of the packet will be that of your router, not the originating machine. b. -- Brian J. Murrell brian@ilinx.com InterLinx Support Services, Inc. brian@wimsey.com North Vancouver, B.C. 604 983 UNIX Platform and Brand Independent UNIX Support - R3.2 - R4 - BSD