[7982] in bugtraq
Re: Incorrect Linux ARP behavior
daemon@ATHENA.MIT.EDU (bobk)
Sat Sep 19 19:02:55 1998
Date: Sat, 19 Sep 1998 12:27:47 -0400
Reply-To: bobk <bobk@SINISTER.COM>
From: bobk <bobk@SINISTER.COM>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <Pine.LNX.3.96.980918214644.28600A-100000@green>
You don't even need a program to demonstrate this behavior:
$ arp -s suspecthost 00:de:ad:c0:ff:ee
$ ping suspecthost
If you get a response, then it is a linux box in promiscuous mode.
don't forget:
$ arp -d suspecthost
When you are done, clearing out the bogus MAC address.
Bob Keyes,
Security Consultant
Cambridge, Mass.
