Re: layer 2&3 firewall/filter?

Dear Davie,

Checkpoint has a feature called anti-spoofing. In this you can assign a
network or a set of network to a nic. This would create and IP/Mac table for
that interface. All packets with an similar ip but different mac would be
rejected from all other interfaces.

I presume that all next generation firewall PIX, Checkpoint etc would have
the same feature but probably under a different heading.

Regards,
Gaurav


On 2/26/06, coder <elite.coder@ntlworld.com> wrote:
> Hi everyone,
>
> I was just wondering, are there any firewalls/packet filters that filter
> at
> layer 3 & layer 2?
> Because I want to filter by MAC address as well as IP address... also if
> the
> firewall/filter logs which MAC address has which IP address,
> I think I can do some simple Intrusion Detection.
>
> The reason I want a layer 2 filter/firewall is so that when an attacker
> spoofs an internal IP address, (which should be ingress filtered),  if the
> packet manages to get into the network, I assume the MAC address will be
> different to the host being attacked... like so:
>
> Attacker                        Spoofed packet                     Host A
> RST Packet/ICMP              Host B
> MAC: 09:09:09:09                                                       MAC
> x:x:x:x                                                             MAC:
> x:x:x:x
> IP:      x.x.x.x
> ----------->                        IP:
> 192.168.0.22       ---------->                          IP: 192.168.0.20
>                                    srcIP: 192.168.0.20
> |
>                                    srcMAC: 09:09:09:09
> <-------------RST/ICMP----------|
>                                    dstIP: 192.168.0.22
>
> "Fraggle Attack".
>
>
> Hoperfully a layer 2 filter/firewall between A and B could stop this
> attack.
>
> Is there anything out there that can stop these type of attacks?
>
> Thanks for your input,
>
> ~Davie Elliott