RE: Using ARP to map a network

yeah - it is flawed :)

MAC to IP mappings as in the ARP table only happens when both source and destination IP hosts are on the same L2, and by definition, L3 network. so a host ARP table on NET X should only show entries for those machines on its same subnet the host had conversations with.

of course, knowing host X IP address and subnet mask, you could start ARPing for all the other available IPs on the range and know what IP addresses are in use, and what not (little issue with machines powered off when you're doing your ARPinging ;))

for all non-local destinations, the only entry the host should have is for the MAC/IP pair of it's default gateway.

one small digression: a host _could_ have MAC/IP pairs in its ARP table for machines not on the same subnet, _if_ the router on the local segment is a Cisco router with "ip proxy-arp" enabled - and even then, it would only have mapped IPs on the non-local network to the router MAC address (as you suggested), but only for router-connected subnets of the same major network the ARPing host is connected to. check

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipr _c/ipcprt1/1cfipadr.htm#1001233

and RFC-1027 to fully understand what problems proxy-arp solves. and btw: Cisco's recommendation (from a security point of view) is to disable proxy ARP if not needed - just to thwart practices as you want to implement :))

> -----Original Message-----

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek