Filter ARP packets with ebtables

Hi,

ARP header filtering is listed as one of ebtables' features and from what I
understand; I should be able to use ebtables to filter or block all ARP
traffics from entering or leaving my system. Here are rules I used

test1:~ # arptables -L

Chain INPUT (policy DROP)

Chain OUTPUT (policy DROP)

Chain FORWARD (policy DROP)

Once these rules were set; I cannot ping from/to the system.  I got
"...Destination Host Unreachable" messages which was promising.  However;
just out of curiousity, I fired up tcpdump and this was what I saw:

test1:~ # tcpdump arp -i eth0 -c 10 -p
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
20:58:14.587211 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:15.588026 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:16.586637 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:17.586365 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:18.603872 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:19.601831 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:20.602637 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:21.601367 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:22.601040 arp who-has 192.168.0.1 tell 192.168.0.2
20:58:23.601845 arp who-has 192.168.0.1 tell 192.168.0.2
10 packets captured
20 packets received by filter
0 packets dropped by kernel

192.168.0.1 is the IP of test1; I pinged test1 from my other system which had
192.168.0.2.

Note that I passed the -p flag to tcpdump to tell tcpdump not to put eth0
into  promiscuous mode.

>From the tcpdump above, it seemed like ARP packets were still entering my
system.  I read all the docs that I think relevant on
http://ebtables.sourceforge.net/documentation.html#docs and searched the
user-list archive but couldn't find any definite answers to my following
questions:

1) Can I use arp/ebtables to totally block out all ARP traffics?  Like I
don't want the kernel to spend any resource processing them, just drop upon
recieve, say to prevent ARPs flood attack.

2) How can I verify that all ARP traffics are dropped?  tcpdump and ethereal
didn't do it for me.

thanks for any help,
Andy

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV