Hello, Justin Booth wrote: > ARPING 192.168.3.1 from 192.168.2.1 eth0 > Unicast reply from 192.168.3.1 [00:E0:81:03:42:B9] 0.671ms > The MAC address listed is the mac addess of eth0 of box B. It seems like > someone could use arping to do local network discovery of attached > multi-homed networks... Ultimatly I would like to stop box B from replying > that it has 192.168.3.1, to keep my attached private networks from being > discovered. I've tried enableing the following in sysctl with no avail I assume you want to block the IP traffic too. Can this work both for ARP and IP?: # subnet 192.168.3.0/24 does not like 192.168.2.0/24: ip rule add prio 100 from 192.168.3.0/24 to 192.168.2.0/24 blackhole # make the above to happen echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter Regards -- Julian Anastasov <ja@ssi.bg> - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
