Hi all
the scenario you described can be a spoofed IP address or a layer 2 attack.
If the intruder is based outside of your network you could use RFC2827
filtering. In simple terms it prevents spoofed addresses by denying your
internal address space to be an outside (of your network) source
address. This can be done by any firewall or by simply using IP ACLs.
Have a look at:
http://www.potaroo.net/ietf/idref/rfc2827/
http://www.faqs.org/rfcs/rfc2827.html
I don't know, if your network is a compny network... However the Cisco
PIX firewals with PIXOS 7.0 and higher (not supported on PIX 501 and
506E) as well as the Cisco ASAs provide two interesting features:
1. Transparent firewall: you turn off routing and then have a real
transparent layer 2 firewall (like a very secure "switch"). This feature
can be implemented when interconnecting different units of your company
sharing the same IP subnet:
http://www.cisco.com/E-Learning/bulk/public/celc/SNPA_Module_2/default.htm
2. "virtual" firewalls (so called "contexts"): You split your PIX/ASA
into several contexts where one could do the layer 2 part and the other
the layer 3 part... (there are of course more benefits using this feature).
Another maybe interesting link:
http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455ace.html
coder wrote:
Hi everyone,
I was just wondering, are there any firewalls/packet filters that filter at
layer 3 & layer 2?
Because I want to filter by MAC address as well as IP address... also if the
firewall/filter logs which MAC address has which IP address,
I think I can do some simple Intrusion Detection.
The reason I want a layer 2 filter/firewall is so that when an attacker
spoofs an internal IP address, (which should be ingress filtered), if the
packet manages to get into the network, I assume the MAC address will be
different to the host being attacked... like so:
Attacker Spoofed packet Host A
RST Packet/ICMP Host B
MAC: 09:09:09:09 MAC
x:x:x:x MAC:
x:x:x:x
IP: x.x.x.x -----------> IP:
192.168.0.22 ----------> IP: 192.168.0.20
srcIP: 192.168.0.20
|
srcMAC: 09:09:09:09
<-------------RST/ICMP----------|
dstIP: 192.168.0.22
"Fraggle Attack".
Hoperfully a layer 2 filter/firewall between A and B could stop this attack.
Is there anything out there that can stop these type of attacks?
Thanks for your input,
~Davie Elliott
