ARPPROTECT(1)

NAME
arpProtect - It monitors associations IP-MAC

SYNOPSIS
arpProtect FILENAME RED_BOUND NOTIFY FILTER INTERFACE

DESCRIPTION
arpProtect allows to monitor IP-MAC used in a specific collision's domain. Its analysis is based on arpwatch's events.

OPTIONS

FILENAME
    File's path in which are defined only allowed IP-MAC associations. File must respect following syntattic rule:

        Examples. Ip's list with mac's list

                        10.0.0.2 10.2.0.2 Aa:Bb:Cc:Dd:Ee:c1 Aa:Bb:Cc:Dd:Ee:c6

        A subnet with a mac's list

                        10.0.0.0/16 Aa:Bb:Cc:Dd:Ee:c1 Aa:Bb:Cc:Dd:Ee:c6

        A subnet and a ip without bond

                        10.0.0.0/16 *
                        10.1.0.1        *

    For each line is possible to define ip's list in that is possible to associate following mac address's list.

EVT_BOUND
    It's the maximun number of times that the found event can verifies inside of temporal window(RANGE). Source ip, findable on log file, is considered responsible. At the overcoming of threshold, depending on configuration, can block source ip or simply notify what is happened. If an ip is blocked, there is also a mark of the moment in which it happens with reference to universal time (UTC) in seconds.

NOTIFY
    There are 4 kinds of notific option: MAIL, LOG, ALL, NOTHING.

    MAIL
        Send a notific email to alla addresses specified on file /etc/aLid/email.conf

    LOG Allow to write a line on log file of application.

    ALL Include both notify's typologies MAIL e LOG.

    NOTHING
        No nothification.

FILTER
    It specifics the policy to adopt considering ip detected. Options accepted are: DROP and NODROP.

    DROP
        It block detected ip in the firewall applying a specific rule.

    NODROP
        It doesn't execute a rule of drop in the firewall.

INTERFACE
    Network interface that you want monitor

EXAMPLES

/etc/aLid/script/arpProtect /etc/aLid/ipmac all drop
    Script is executed using associations defined in file /etc/aLid/ipmac, all as notify rule and drop as filter.

FILES

/etc/aLid/aLid.conf
    Configuration's file of the application.

REQUIREMENT

arpwatch
    Arpwatch - http://www.securityfocus.com/tools/142

SEE ALSO
sharedTail, aLid.conf

AUTHOR
Andrea Martire (andreamartire@gmail.com)

COPYRIGHT AND LICENSE
Copyright AX 2010 Andrea Martire <andreamartire@gmail.com>. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.