Re: Wackamole problem with arp cache on firewall/gateway

Theo Schlossnagle wrote:

> What kind of firewall is it?


OpenBSD 3.4.  I can't find anything in the  log or pf log files.   I'm 
research for the kernel config option.  If anyone knows it (and if it 
can be set for only my interal interafce) I would appreciate it.

>
> So.  Try adding eth0:0.0.0.0/32 and eth0:255.255.255.0/32 and and 
> eth0:networkaddress/32 and eth0:broadcastaddress/32 (where network 
> address or broadcast address is the IP network address and IP 
> broadcast address on that subnet, respectively).


Tried this,  no luck yet.

>
> Different devices and OSs respond differently to unsolicited ARP 
> responses.  Some take "protective measures" to disable this to prevent 
> "arp-spoofing" attacks.  On FreeBSD/NetBSD/OpenBSD I believe there is 
> a kernel option to allow/disallow this.  Sometimes systems are more 
> receptive to unsolicited arp resopnses to IP network, IP broadcast, IP 
> subnet, or IP subnet broadcast addresses.
>
> Check the logs on your firewall to see if it sees the ARP request but 
> is rejecting it.

It looks like it may have worked once (I see some arp info overwritten 
messgages).  However, I can not seem to make it work consistantly.

Thanks,
-Rama