arpCounterattack 1.2.0 security =2

Detects and remedies ARP attacks
Maintained by: spawk@acm.poly.edu
Port Added: 27 Apr 2011 17:42:12
License: not specified in port

---

---

arpCounterattack is a program for detecting and remedying "ARP attacks." It
monitors traffic on any number of Ethernet interfaces and examines ARP replies
and gratuitous ARP requests. If it notices an ARP reply or gratuitous ARP
request that is in conflict with its notion of "correct" Ethernet/IP address
pairs, it logs the attack if logging is enabled, and, if the Ethernet
interface that the attack was seen on is configured as being in aggressive
mode, it sends out a gratuitous ARP request and a gratuitous ARP reply with
the "correct" Ethernet/IP address pair in an attempt to reset the ARP tables
of hosts on the local network segment. The corrective gratuitous ARP request
and corrective gratuitous ARP reply can be sent from an Ethernet interface
other than the one that the attack was seen on.

WWW: http://acm.poly.edu/wiki/ARP_Counterattack

-Boris Kochergin <spawk@acm.poly.edu>

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

NOTE: FreshPorts displays only required dependencies information. Optional dependencies are not covered.
Required Libraries: net/libdnet
There are no ports dependent upon this port

---

To install the port: cd /usr/ports/security/arpCounterattack/ && make install clean
To add the package: pkg_add -r arpCounterattack

---

Configuration Options

     No options to configure

---

Master Sites:

http://isis.poly.edu/~bk/arpCounterattack/

http://bk.macroblock.net/arpCounterattack/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.

Repeated words are are hard to to find sometimes.

Approved by:    portmgr (itetcu)

arpCounterattack is a program for detecting and remedying "ARP attacks." It
monitors traffic on any number of Ethernet interfaces and examines ARP replies
and gratuitous ARP requests. If it notices an ARP reply or gratuitous ARP
request that is in conflict with its notion of "correct" Ethernet/IP address
pairs, it logs the attack if logging is enabled, and, if the Ethernet
interface that the attack was seen on is is configured as being in aggressive
mode, it sends out a gratuitous ARP request and a gratuitous ARP reply with
the "correct" Ethernet/IP address pair in an attempt to reset the ARP tables
of hosts on the local network segment. The corrective gratuitous ARP request
and corrective gratuitous ARP reply can be sent from an Ethernet interface
other than the one that the attack was seen on.

WWW: http://acm.poly.edu/wiki/ARP_Counterattack

PR:             ports/151973
Submitted by:   Boris Kochergin <spawk@acm.poly.edu>

12 vulnerabilities affecting 17 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities