Function of the Plugin ARP

Hello,

Is the LooknStop ARP plugin used only for monitoring ARP packets, or does it also take an active role and allow you to block unrequested ARP replies, block ARP Floods, etc.? Where can I learn more about its function and use?

Thank you

 

Hello Devinco,


You can I learn more about its function and use from the links below.


http://www.looknstop.com/En/plugin.htm

http://www.looknstop.com/En/plugin_loggedevent_use.htm

And you can also access these links from help file in LnS.


Good Luck

 

Hello Kush,

Thanks for the links.
But it is still unclear (to me) whether the plugin merely logs and displays ARP packets, or it allows one to actively filter/process them.
The second link hints at this by mentioning real-time processing and post-processing of events, but nothing about what it can do specifically.

 

Yes your correct there should be more information on ARP,did you read the help file in LnS about Plugins configuration?

(If a plugin offers its own configuration, use the Configure button (after having selected it).


So if you can configure the ARP packets,there will be an option for this in the Configure the plugin.

Some (not all) plugins can be configured. To Configure a plugin, select it (highlight it) from the Options > Advanced Options > Plugins window and click the Configure button.

Sorry never used the ARP Plugin,but I do use a few others Plugins for extra log information.


I am sure there are more advanced users who do use it and will be able to help you out more.

 

I don't have LooknStop, so I can't look at the help file.

Thanks

 

Hi, Devinco

,

Take Care,
TheQuest

 

Hi TQ,

Hope your quest is going well!
In case you are wondering about the reason for this thread, it is to learn about a little discussed topic (here on Wilders) ARP cache poisoning and ways to protect against it. Here is the thread that sparked this thread: https://www.wilderssecurity.com/showthread.php?t=128300

 

Hi, Devinco

I was reading [following] the other tread which led me to see if you had posted over here on LnS.

The Smilies were ment to say, I was getting lost in trying to understand what was being said. ,

Take Care,
TheQuest

 

TQ,

The SecurityNow articles linked to from the other thread provide a good overview of the ARP problem. Is it a huge problem? Probably not, but it is good to learn about and if there is something one can do about it, why not?

 

Hello Devinco,


Very true so I installed PluginARP.dll and this is what I have found out below:
Information:
ARP
Add APR Packet decoding to Look"n"Stop
Type:Log Display

When I went to configure the PluginARP.dll
a box popped-up!

ARP extension Plugin
V1.01 Beta01

That's it!


And no other options to configure it,so I guess it's safe to say the PluginARP.dll is just for detailed information add-on for the Log Display of LnS so you can view the packet fully for all information on incoming ARP packets,and I rechecked the link,and it does not say anything that you can configure it.

But it did say only this:

*ARP packet viewer
*Customized display of logged ARP packets

And that's what it does,if it can be configured? I must have missed something.But I did check everything and no options to configure it.

Hope that helps

 

It helps a lot and answers my question. Thanks Kush!

 

Hi,

If you want to create specific ARP packet filtering, the RawRuleEdition plugin probably could perhaps help you.

Frederic