Re:Linux 3.13
by esbranson on Monday January 20, 2014 @10:14AM
(#7089865)
I've been wanting to implement a dynamic ARP filter (DHCP snooping + ARP filtering) for ages now, but arptables/ebtables just didn't cut it. Hopefully this will be easier/viable now. Because I still don't think ArpON sniffs DHCP leases for its mapping (it intercepts and replays ARP requests or something) and it doesn't filter rogue DHCP servers. I'm just amazed ARP spoofing/ARP cache poisoning is still a viable attack vector on home networks in 2014.
[ Parent
| on HN ]
Please see the "master" branch of FreeRADIUS. https://github.com/FreeRADIUS/freeradius-server/
It can accept both DHCP and ARP protocols, and will decode them into attribute-value pairs. Those can then be referenced in a policy language, and stored to / read from a database.
I'm the author. :) It's no longer just a RADIUS server. I've been looking for a DHCP / ARP checker for a while, and couldn't find anything useful. Rather than writing something from scratch, I decided it was easier to just add ~2K LoC to FreeRADIUS. I could then leverage the policy language and database integration, so I didn't have to re-write all of that, either.
Excellent. :) I will look into this.
I am targeting embedded devices on OpenWRT, which means it needs to be as simple and small as possible, so I hope the code is tight.
But on the other hand, I would prefer to not reinvent the wheel.
The code is tiny. It already runs on OpenWRT, so there's no issue there.
You need to implement DHCP Snooping at Layer 2 for it to really work, and these days I think all major switch vendors support it. Unless you're building a Linux L2 switch I don't see why you would want to implement DHCP Snooping.