![nanog logo](/images/nanog-logo.png)
nanog mailing list archives
Re: Proxy ARP detection (was re: best practice for advertising peering fabric routes)
From: Jimmy Hess <mysidia () gmail com>
Date: Wed, 15 Jan 2014 23:17:29 -0600
On Wed, Jan 15, 2014 at 10:49 PM, ML <ml () kenweb org> wrote:
Shouldn't ARP inspection be a common feature?
Dynamic ARP inspection is mostly useful only when the trusted ports receive their MAC to IP address mapping from a trusted DHCP server, and the trusted mapping is established using DHCP snooping. Or else, you have a manually entered entries in the secure ARP database of MAC to IP mappings. Which most operators would be resistant to dealing with, because of all the extra work. -It's not as if the switches know what the valid subnets are and suppress ARP requests for outside networks. Therefore, in most cases; ARP inspection won't be used, except for DHCP clients. Arp inspection goes hand-in-hand with increasing resistance against a Man in the Middle attack from a compromised workstation on a LAN, using ARP hijacking to capture traffic or distribute malware to a neighboring workstation. In most cases, DHCP-based configuration will not be used for routers (the very devices that might inadvertently have proxy-arp).... -- -JH
Current thread:
- Re: Proxy ARP detection, (continued)
- Re: Proxy ARP detection Clay Fiske (Jan 15)
- Re: Proxy ARP detection Eric Rosen (Jan 15)
- Re: Proxy ARP detection Patrick W. Gilmore (Jan 15)
- Re: Proxy ARP detection Jimmy Hess (Jan 15)
- Re: Proxy ARP detection Vlade Ristevski (Jan 16)
- Re: Proxy ARP detection Niels Bakker (Jan 16)
- Re: Proxy ARP detection Warren Bailey (Jan 16)
- Re: Proxy ARP detection Jimmy Hess (Jan 16)
- Re: Proxy ARP detection Niels Bakker (Jan 16)
- Re: Proxy ARP detection (was re: best practice for advertising peering fabric routes) ML (Jan 15)
- Re: Proxy ARP detection (was re: best practice for advertising peering fabric routes) Jimmy Hess (Jan 15)
- Re: best practice for advertising peering fabric routes Niels Bakker (Jan 15)
- Re: best practice for advertising peering fabric routes Niels Bakker (Jan 15)