Re: IP/MAC pairs

Op vr, 09-03-2007 te 19:15 +0300, schreef wing:
>  I have linux bridge with 3 interfaces:
> 					ISP
> 					 ^
> 					 |
> 					 |
> 		          SUB1 <-------bridge-------> SUB2
> 
>  So, my network have 3 ethernet "segment's", I need  prevent arp-spoofing and changing
> MAC/IP pairs by users. I found 2 ways:
> 
> 1) make file with 254 strings "00:11:22:33:44:55=192.168.0.1,etc" and then load it into the ebtables:
> ebtables -A FORWARD -p IPv4 --among-src-file /etc/ethers -j ACCEPT
> 
> 2) add 254 rules to ebtables such as:
> ebtables -A FORWARD -p IPv4 --ip-src 192.168.0.1 -s ! 00:11:22:33:44:55 -j DROP
> 
> And, my questions: which method will work fastly? Are there other ways to do this?

The first one will be faster, it uses hashing. The among match was made
for things like anti-spoofing rules.

cheers,
Bart



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV