Skip to content
master
Switch branches/tags
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 

README

- --------- anticap --

anticap is a kernel patch for various operating systems (i mean: written for) that
effectively makes ettercap (http://ettercap.sf.net) and other arp-poisoning based
sniffers useless.

a kernel patched with anticap uses a simple tecnique when dealing with arp replies:
- if the entry doesn`t exist in the arp table, it inserts into the table
- if the entry exitsts in the arp table, and the sysctl variable is set to `1', this
  is almost certainly arp spoofing (sorry, you have to put the sysctl off before
  changing a NIC :) and the packet is discarded and a diagnostic message bailed out
  to syslogd

- --------- installation -
for linux 2.[24]= {
    linux-box# cd /usr/src/linux
    linux-box# patch -p0 < anticap-linux-2-[24].diff
    linux-box# [ .. your usual kernel reconfiguration commands here .. ]
    linux-box# reboot
}

for freebsd 4.6 [not tested previous releases, sorry]= {
    bsd-box# cd /sys
    bsd-box# patch < anticap-freebsd-4-6.diff
    bsd-box# [ .. your usual kernel reconfiguration commands here .. ]
    bsd-box# reboot
}

for netbsd 1.5.3 [not tested previous releases, sorry]= {
    nbsd-box# cd /sys
    nbsd-box# patch < anticap-netbsd-1-5-3.diff
    nbsd-box# cd netinet
    nbsd-box# make includes
    nbsd-box# [ .. your usual kernel reconfiguration commands here .. ]
    nbsd-box# cd /usr/src/sbin/sysctl
    nbsd-box# make clean all install
    nbsd-box# reboot
}

- --------- usage -
when you reboot, no leet messages will be displayed, just a new sysctl that enables/
disables anticap.

on a netbsd box you`ll see:
    bsd-box# sysctl -a | grep arp
    net.inet.ip.denyarppoisoning = 1
    bsd-box#

on a freebsd box:
    bsd-box# sysctl -a | grep deny_arp
    net.link.ether.inet.deny_arp_poisoning: 1
    bsd-box#

on a linux (2.2 or 2.4) box:
    linux-box# sysctl -a | grep arp_deny
    net/ipv6/neigh/default/arp_deny_poisoning = 1
    net/ipv4/neigh/default/arp_deny_poisoning = 1
    linux-box#

names are different to comply with os-specific sysctl names .. i tried to give variables
names the most similar to the existing ones.

sorry to ettercap developers ..

cheers, 
    vjt <vjt@azzurra.org>

About

Naive ARP poisoning mitigation

Resources

Releases

No releases published

Packages

No packages published