ARP poisoning troubleshooting

leblanc
leblanc used Ask the Experts™
on
It looks like my network got attacked by ARP poisoning. I see spoofing MAC addresses. When I shut down one, another one po up somewhere else. I am not sure how to deal with this. Any thoughts will be greatly appreciated. Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
Commented:
Defence depends on options that are available on switch.
Manufacturer?
Dave HoweSoftware and Hardware Engineer

Commented:
many switches allow you to shut down a port if more than a certain number of mac addresses are seen from it - that is the usual method (if you have it). Cisco call that "port security" and obviously other vendors call it something else :)

As Predrag says, we would need further info to give a more detailed answer.
leblancAccounting

Author

Commented:
Sorry, My network is all Juniper ex2200 and ex4200. So if I understand correctly, you can shut down some of the ports now to stop this issue? Thx
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Software and Hardware Engineer
Commented:
Its a little more subtle than that.

As I read this page by setting a mac limit of (say) 5 you can say that any port on the switch will only accept the first five mac addresses it sees, and any mac addresses beyond those will be dropped (silently) and the action logged.

this means that you can both mitigate the extra macs and identify which port the spoofer is connected to, in order to track them down.

you can also hard-lock certain macs to certain ports if you wish - so that the port will only accept that one mac or list of macs - but that is considerable administrative overhead unless the attached nics are pretty static.

my reading is that, in config mode, at the ethernet-switching-options>>secure-access-port level, the command

set interface all mac-limit 5

would cause the mac limit to go to 5 and drop as the action (default)

you might first want to clear already learned macs with

clear ethernet-switching-table

to prevent any valid users being accidentally locked out by this move; you can also clear down individual ports with the same command (and a final argument of the port should you want to just release one port) should a sixth device (laptop, say) be added to a port legitimately in future.
leblancAccounting

Author

Commented:
When you set interface all mac-limit 5, will it set for all access ports? I have a stack of 4 48-port switches.
Dave HoweSoftware and Hardware Engineer
Commented:
the <all> designates the port on the switch (as in all of them) - you can substitute the actual port if you want to do this at a finer grained level (see the link I posted)
it will need doing per switch, and you should also set the switches to send their logs via syslog to a central machine so you can monitor them for the drop alerts.
leblancAccounting

Author

Commented:
That is a very good idea. I will try that. Now what if my access port is connected to an AP. There are a lot of hosts going through an AP. Correct? So how will I deal with that? Thanks
Dave HoweSoftware and Hardware Engineer
Commented:
normally you wouldn't do that with a trunk port, and a AP counts as a trunk (so, exclude the links between switches too)

if its an AP though, normally it will have its own mac table and so forth, and you will have to deal with that separately.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial