Please help experts write an ARP batch processing defense - China DOS Union Forum

In fact, the frequent momentary disconnections or large - scale network outages are mostly caused by ARP spoofing. ARP spoofing attacks have become the number - one culprit that disrupts internet cafe operations and a major headache for internet cafe owners and network administrators.

In terms of the ways to affect the smoothness of network connection, ARP spoofing is divided into two types. One is the spoofing of the router's ARP table; the other is the gateway spoofing of the internal network PC.

The principle of the first type of ARP spoofing is - intercepting gateway data. It notifies the router of a series of incorrect internal network MAC addresses and continuously does so at a certain frequency, so that the real address information cannot be saved in the router through update. As a result, all data of the router can only be sent to the incorrect MAC address, causing normal PCs to be unable to receive information. The principle of the second type of ARP spoofing is - forging a gateway. Its principle is to set up a fake gateway, so that the PC deceived by it sends data to the fake gateway instead of going online through the normal router path. To the PC, it is like being unable to access the internet, "the network is disconnected".

Generally speaking, the consequences of ARP spoofing attacks are very serious. In most cases, it will cause large - scale disconnections. Some network administrators don't understand this very well. When a fault occurs, they think there is no problem with the PC, the switch doesn't have the "ability" to disconnect, and the telecom doesn't admit to a broadband fault. And if the first type of ARP spoofing occurs, as long as the router is restarted and the network can be fully restored, then the problem must be with the router. For this reason, broadband routers have taken a lot of "blame".

As manufacturers of internet cafe routers, they have to do a lot of work, both within and outside their duties, to prevent ARP spoofing. First, input the IP - MAC of all PCs into a static table in the broadband router. This is called router IP - MAC binding. Second, strongly advise network administrators to set up static ARP information of the gateway on all internal network PCs. This is called PC IP - MAC binding. Generally, manufacturers require both tasks to be done, which is called IP - MAC two - way binding.

Floor1　maikaluo	Posted 2008-04-16 20:54
初级用户　Posts 13　Credits 37
The ARP attacks in our school are very rampant. Please help all the experts write an ARP batch processing defense. I am deeply grateful here

Floor2　rj1005	Posted 2008-04-30 22:40
新手上路　Posts 7　Credits 14
I want to know too

Floor3　mcpake	Posted 2008-05-03 19:03
新手上路　Posts 1　Credits 2
arp -d arp -s 路由IP Save as a bat Give it a try. The route has binding function, and it can also be bidirectionally bound. That's the best. Please correct if there's anything wrong, next floor.

Floor4　qja	Posted 2008-06-02 20:31
新手上路　Posts 6　Credits 11
Bind your own IP and MAC addresses as well

Floor5　cuihanjie	Posted 2008-06-04 23:51
初级用户　Posts 13　Credits 26
Still, download an ARP firewall.

Floor6　sharpkingby	Posted 2008-07-29 21:39
新手上路　Posts 9　Credits 17

Floor7　agt66	Posted 2008-07-31 19:49
新手上路　Posts 5　Credits 10
You say what is ARP? Not very clear, do you know?

Floor8　tinlin	Posted 2008-08-21 12:27
初级用户　Posts 76　Credits 160
In fact, the frequent momentary disconnections or large - scale network outages are mostly caused by ARP spoofing. ARP spoofing attacks have become the number - one culprit that disrupts internet cafe operations and a major headache for internet cafe owners and network administrators. In terms of the ways to affect the smoothness of network connection, ARP spoofing is divided into two types. One is the spoofing of the router's ARP table; the other is the gateway spoofing of the internal network PC. The principle of the first type of ARP spoofing is - intercepting gateway data. It notifies the router of a series of incorrect internal network MAC addresses and continuously does so at a certain frequency, so that the real address information cannot be saved in the router through update. As a result, all data of the router can only be sent to the incorrect MAC address, causing normal PCs to be unable to receive information. The principle of the second type of ARP spoofing is - forging a gateway. Its principle is to set up a fake gateway, so that the PC deceived by it sends data to the fake gateway instead of going online through the normal router path. To the PC, it is like being unable to access the internet, "the network is disconnected". Generally speaking, the consequences of ARP spoofing attacks are very serious. In most cases, it will cause large - scale disconnections. Some network administrators don't understand this very well. When a fault occurs, they think there is no problem with the PC, the switch doesn't have the "ability" to disconnect, and the telecom doesn't admit to a broadband fault. And if the first type of ARP spoofing occurs, as long as the router is restarted and the network can be fully restored, then the problem must be with the router. For this reason, broadband routers have taken a lot of "blame". As manufacturers of internet cafe routers, they have to do a lot of work, both within and outside their duties, to prevent ARP spoofing. First, input the IP - MAC of all PCs into a static table in the broadband router. This is called router IP - MAC binding. Second, strongly advise network administrators to set up static ARP information of the gateway on all internal network PCs. This is called PC IP - MAC binding. Generally, manufacturers require both tasks to be done, which is called IP - MAC two - way binding.

Floor9　xuye	Posted 2008-08-22 17:22
初级用户　Posts 34　Credits 79
Just check it on Baidu Zhidao, and you'll know! And it's very comprehensive!