IP Sentinel
IP Sentinel is a tool that tries to prevent unauthorized usage of IP addresses within an ethernet broadcast domain by answering ARP requests. After receiving faked replies, requesting parties store the MAC in their ARP tables and will send future packets to this invalid MAC, rendering the IP unreachable.
| Tags | Networking |
|---|---|
| Licenses | GPL |
| Operating Systems | POSIX Linux |
| Implementation | C |
Recent releases
- 29 Mar 2005 14:15
Changes: This version adds an "--action" option to execute a program when a disallowed ARP packet is detected. Sorting of IP addresses happens in an endian-neutral manner, and support for the old, deprecated logging format was physically removed from the source.
- 16 Dec 2004 04:01
Changes: This version made it possible to block hosts with a certain MAC address regardless of their IP. This feature could help to isolate hosts infected by worms or viruses. The default options were changed.
- 17 Jun 2004 08:31
Changes: Code cleanups are the main change in this version. Compilation issues with dietlibc 0.26 were fixed, and the tai64n format is now used for timestamps.
- 15 Dec 2003 17:19
Changes: This release fixes the handling of MAC-annotated IPs when there exists a more general rule. It provides workarounds for gcc and dietlibc bugs also, and the behavior on duplicate networks with MAC-annotation is now predictable so that e.g. MAC pools for networks can be configured.
- 30 Oct 2003 19:49
Changes: This version fixes a bug in the FROM-mode in combination with 0.0.0.0 IPs, which are used by DHCP or DAD. It is now permissible to specify MACs of source-addresses, and to poison an intruders IP when he has sent a request. In combination with MAC-tagged IP addresses, the correct MAC can be propagated when an intruder uses the IP of temporarily turned off machines. Some other parts of the code were made more RFC826 compliant.
