Message-ID: <40679ED8.1060502@tmr.com>
Date: Sun, 28 Mar 2004 22:58:16 -0500
From: Bill Davidsen <davidsen@tmr.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6b) Gecko/20031208
MIME-Version: 1.0
To: Jad Saklawi <jad@saklawi.info>
CC: linux-kernel@vger.kernel.org, hisham@hisham.cc, llug-users@greencedars.org
Subject: Re: Fwd: MAC / IP conflict
References: <405D239B.30602@mail.portland.co.uk>
In-Reply-To: <405D239B.30602@mail.portland.co.uk>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1038
Lines: 25

Jad Saklawi wrote:
> ----- Forwarded message from Hisham Mardam Bey -----
>    Date: Sun, 21 Mar 2004 13:52:59 +0200
> 
> In short, I need to detect when someone on the network uses my MAC and
> my IP address.
> 
> Longer story follows. I am on a LAN which might have some potentially
> dangerous users. Those users might spoof my MAC address and additionally
> use my IP address, thus forcing my box to go offline, and not be able to
> communicate with my gateway. What I need is a passive way to check for
> something of the sort, and perhaps a notofication into syslog (the
> latter is not very important).

Use arpwatch, it detects ALL changes of IP<=>MAC mapping.

-- 
bill davidsen <davidsen@tmr.com>
   CTO TMR Associates, Inc
   Doing interesting things with small computers since 1979
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/