Re: please help me with ebtables, i need to block arp replys

On 08/19/08 18:14, mikis stepan wrote:
> Hi, please i need your help, i need to block all the arp replys in my 
> lan, except the ones that comes from a specific machine, i have made 
> a program that will response all the arp request that are made in the 
> lan, in my program i put on the mac source field of the ethernet 
> header of each arp reply packet, the mac of this machine, because i 
> want to put some rule (maybe with ebtables?) that will drop all the 
> arp replys packets from the lan except those than comes from the 
> machine where i run my program (i think that the rule will  have to 
> filter by source mac address, thats why all the arp replys packets 
> that can be accepted generated by my program, have in the ethernet 
> header as mac source address, the mac of this machine). I have the 
> linksys wrtsl54gs with openwrt whiterussian RC6, could i do this with 
> ebtables? can i block the arp replys in the linksys that goes from 
> for example machine A to machine B? the linksys can see the replys 
> that are not for him or am i wrong?? or the arp replys that are not 
> specifically for the router are not seen by the router? could 
> ebtables help me with this? thanks a lot in advance, im sorry to 
> bother you.

Are you trying to prevent / intercept ARP queries / replies for multiple 
computers on your LAN?  I.e. two computers that are plugged in to the 
same switch that your Linksys is plugged in to?  If so, then you will 
have a lot of trouble doing this.  The problem arises from the fact that 
the machine that the ARP request is for will reply to the ARP request. 
You can configure your Linksys (running non standard software) to reply 
to the request too.  However it will be a race to see who's replies 
reach the original requester first, yours or the real machine's.  This 
is also presuming that the switch in the middle will not already know 
where the packet needs to be sent and send it directly to that station 
(being ARPed for) rather than forwarding it out all interfaces on the 
switch.  In this scenario (L3 type switch) your Linksys will very likely 
not see the ARP request at all.

Now if you are wanting to intercept and act on ARP requests that come in 
one interface and go out another on the Linksys that are bridged 
together, yes you can do what you are wanting to do.

I don't know why, but I have a hair on the back of my head that said you 
are wanting to do more of the former than the later.  But I'll see what 
you are wanting to do before proceeding.



Grant. . . .

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/