2

Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?

Can TCP stack 'shutdown' or stop in order to protect itself ?

  • A duplicate of what? Do you mean if machine A detects that another machine out there is using the same IP as A? Or that it sees multiple other machines (mac addresses) out there with the same IP? ? Exactly what sort of threat or attack are you thinking of? Why would shutting down the stack protect itself? – nealmcb Apr 28 '11 at 5:15
  • If you are afraid of arp spoofing the you can easily manually set mac address for a ip. In windows the arp command lets you do it. – KilledKenny Apr 28 '11 at 15:22
3

Many switches and routers now have active anti-spoofing, either alerting on duplicates, or entirely blocking IP addresses which are on a port where that address should never be. This is the only sensible use I can think of.

I don't think in any instance it would be a good idea to shutdown of the stack when it discovers its IP address has been spoofed - that would lead to really simple denial of service attacks (the attacker could just increment their IP address through the entire valid range, thus knocking off all devices that do this)

When you say 'protect itself' - as @nealmcb said - against what? An IP spoof is not a direct attack against another network address, in fact usually it is used when trying to pretend to be the valid device, so shutting the real one down would make that much simpler for an attacker as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.