2

Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?

Can TCP stack 'shutdown' or stop in order to protect itself ?

Improve this question
2
  • A duplicate of what? Do you mean if machine A detects that another machine out there is using the same IP as A? Or that it sees multiple other machines (mac addresses) out there with the same IP? ? Exactly what sort of threat or attack are you thinking of? Why would shutting down the stack protect itself?
    – nealmcb
    Commented Apr 28, 2011 at 5:15
  • If you are afraid of arp spoofing the you can easily manually set mac address for a ip. In windows the arp command lets you do it.
    – KilledKenny
    Commented Apr 28, 2011 at 15:22

1 Answer 1

Reset to default
3

Many switches and routers now have active anti-spoofing, either alerting on duplicates, or entirely blocking IP addresses which are on a port where that address should never be. This is the only sensible use I can think of.

I don't think in any instance it would be a good idea to shutdown of the stack when it discovers its IP address has been spoofed - that would lead to really simple denial of service attacks (the attacker could just increment their IP address through the entire valid range, thus knocking off all devices that do this)

When you say 'protect itself' - as @nealmcb said - against what? An IP spoof is not a direct attack against another network address, in fact usually it is used when trying to pretend to be the valid device, so shutting the real one down would make that much simpler for an attacker as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .