On Thu, 10 Feb 2005 13:19:51 +0100, Luca Ferrari <fluca1978@xxxxxxxxxxx> wrote: > in my internal network someone is using a kind of arp poisoning, since two (or > more) computers results _sometimes_ associated to the same MAC address. Since > I've got a linux firewall-proxy (iptables and squid) that limits the traffic > depending on the mac address, this is a problem for me. Is there a solution > to solve the problem? Someone else mentioned ip-sentinel. Arpwatch is also a useful tool. If this is on your internal network, you are best off tracing down which devices are conflicting and figuring out if this is intentional or some sort of bug. Someone capable of arp poisoning on your internal network might have done a lot more than suck bandwidth -- they can launch a number of man-in-the-middle attacks. thornton - : send the line "unsubscribe linux-admin" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
