Skip to content

Instantly share code, notes, and snippets.

@jblachly

jblachly/ip-nospoof-fail.md

Last active February 23, 2016 03:50
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jblachly/444e4760ddbeba7e1a9e to your computer and use it in GitHub Desktop.
Save jblachly/444e4760ddbeba7e1a9e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ip-nospoof-fail.md
  1. ARP queries are both blocked and not blocked. Snoop results:

13 0.47698 OLD-BROADCAST -> (broadcast) ARP C Who is 169.254.43.135, 169.254.43.135 ?

Here, dhcpcd 6.7.1 has given up on finding a DHCP server (the frames were blocked) and is trying to pick a link local address

However, when re-running dhcpcd later I captured the following blocked frame with dtrace

ff ff ff ff ff ff d2 e8 b0 94 ee 08 08 06 00 01
08 00 06 04 00 01 d2 e8 b0 94 ee 08 a9 fe 2b 87
00 00 00 00 00 00 a9 fe 2b 87
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment