1

Let's say on my network there is a hacker who floods my computer with arp messages to associate his MAC address with the IP of the computer I want to reach.

It's like he sends the following message continuously (100 packets per second) to my computer:

192.168.1.2 (my target) has 0:0:0:0:0:1 (hacker's MAC address)

the following does not work, I end up with the two association in arp -a:

arp -a -d; arp -s 192.168.1.2 0:0:0:0:0:2 (the real MAC address of the target)

Is it possible on macOS to drop the arp packets from the hacker?

  • I'm voting to close this question as off-topic because it's not about Apple hardware, software, or services as defined in the Help Center – Allan Aug 25 '17 at 0:11
  • 1
    I think it is, since on linux I could use arptables, I want to know how I should do it with mac tools – Elio Maisonneuve Aug 25 '17 at 0:13
1

You could use a static ARP entry to solve the problem. This is done using "arp -s" as you write in your question. The second association is not a problem as the static entry will take precedence.

Alternatively you could block the MAC address of the spoofer. For example you could use the "ifconfig bridge" command to create a bridge over which you tunnel all packets from the evil MAC-address. When configuring the bridge, set that it tags the packets.

Then you can use the pf packet filter to examine all the tagged packets and possible reject them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .