On Wed, 21 Jun 2000, Kenn Humborg wrote:
> If a machine on one side tries to send to a machine on the other
> side, it will look at the IP address, see that it's the same subnet
> and then do an ARP. Nothing will respond to that ARP,
That's what you might think would happen... but linux will
actually reply to the ARP even if it doesn't arrive at that interface.
(see my next post for example).
> and the IP
> layer will eventually return Destination Host Unreachable.
>
> That's the "operational" point of view. The "security" point
> of view is different: Badclient can add entries to its own
> ARP table saying that Goodclient's ethernet address is the
> address of Moo. Then Moo will route for it, if forwarding
> is enabled.
>
yep... that was going to be my next point of argument with kev..
kev: "'tis all well and good, but it works"
me: "ok, but the security is reliant on routing.. what if i fire icmp
redirects at the firewall, ARP it..?"
> Later,
> Kenn
>>>
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
