Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?

Can TCP stack 'shutdown' or stop in order to protect itself ?

share|improve this question
    
A duplicate of what? Do you mean if machine A detects that another machine out there is using the same IP as A? Or that it sees multiple other machines (mac addresses) out there with the same IP? ? Exactly what sort of threat or attack are you thinking of? Why would shutting down the stack protect itself? –  nealmcb Apr 28 '11 at 5:15
    
If you are afraid of arp spoofing the you can easily manually set mac address for a ip. In windows the arp command lets you do it. –  KilledKenny Apr 28 '11 at 15:22
add comment

1 Answer

Many switches and routers now have active anti-spoofing, either alerting on duplicates, or entirely blocking IP addresses which are on a port where that address should never be. This is the only sensible use I can think of.

I don't think in any instance it would be a good idea to shutdown of the stack when it discovers its IP address has been spoofed - that would lead to really simple denial of service attacks (the attacker could just increment their IP address through the entire valid range, thus knocking off all devices that do this)

When you say 'protect itself' - as @nealmcb said - against what? An IP spoof is not a direct attack against another network address, in fact usually it is used when trying to pretend to be the valid device, so shutting the real one down would make that much simpler for an attacker as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.