Function of the Plugin ARP

Discussion in 'LnS English Forum' started by Devinco, Apr 19, 2006.

Thread Status:
Not open for further replies.
  1. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    Hello,

    Is the LooknStop ARP plugin used only for monitoring ARP packets, or does it also take an active role and allow you to block unrequested ARP replies, block ARP Floods, etc.? Where can I learn more about its function and use?

    Thank you
     
  2. Kush

    Kush Registered Member

    Joined:
    Dec 10, 2004
    Posts:
    138
    Location:
    Montreal,Canada
  3. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    Hello Kush,

    Thanks for the links.
    But it is still unclear (to me) whether the plugin merely logs and displays ARP packets, or it allows one to actively filter/process them.
    The second link hints at this by mentioning real-time processing and post-processing of events, but nothing about what it can do specifically.
     
  4. Kush

    Kush Registered Member

    Joined:
    Dec 10, 2004
    Posts:
    138
    Location:
    Montreal,Canada

    Yes your correct there should be more information on ARP,did you read the help file in LnS about Plugins configuration?

    (If a plugin offers its own configuration, use the Configure button (after having selected it).


    So if you can configure the ARP packets,there will be an option for this in the Configure the plugin.

    Some (not all) plugins can be configured. To Configure a plugin, select it (highlight it) from the Options > Advanced Options > Plugins window and click the Configure button.

    Sorry never used the ARP Plugin,but I do use a few others Plugins for extra log information.



    I am sure there are more advanced users who do use it and will be able to help you out more.
     
    Last edited: Apr 19, 2006
  5. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    I don't have LooknStop, so I can't look at the help file.

    Thanks
     
  6. TheQuest

    TheQuest Registered Member

    Joined:
    Jun 9, 2003
    Posts:
    2,304
    Location:
    Kent. UK by the sea
    Hi, Devinco

    o_O :eek: :blink: , :D

    Take Care,
    TheQuest :cool:
     
  7. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    Hi TQ,

    Hope your quest is going well!
    In case you are wondering about the reason for this thread, it is to learn about a little discussed topic (here on Wilders) ARP cache poisoning and ways to protect against it. Here is the thread that sparked this thread: https://www.wilderssecurity.com/showthread.php?t=128300
     
  8. TheQuest

    TheQuest Registered Member

    Joined:
    Jun 9, 2003
    Posts:
    2,304
    Location:
    Kent. UK by the sea
    Hi, Devinco

    I was reading [following] the other tread which led me to see if you had posted over here on LnS.

    The Smilies were ment to say, I was getting lost in trying to understand what was being said. :( , :)

    Take Care,
    TheQuest :cool:
     
  9. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    TQ,

    The SecurityNow articles linked to from the other thread provide a good overview of the ARP problem. Is it a huge problem? Probably not, but it is good to learn about and if there is something one can do about it, why not?
     
  10. Kush

    Kush Registered Member

    Joined:
    Dec 10, 2004
    Posts:
    138
    Location:
    Montreal,Canada

    Hello Devinco,


    Very true so I installed PluginARP.dll and this is what I have found out below:
    Information:
    ARP
    Add APR Packet decoding to Look"n"Stop
    Type:Log Display

    When I went to configure the PluginARP.dll
    a box popped-up!

    ARP extension Plugin
    V1.01 Beta01

    That's it!


    And no other options to configure it,so I guess it's safe to say the PluginARP.dll is just for detailed information add-on for the Log Display of LnS so you can view the packet fully for all information on incoming ARP packets,and I rechecked the link,and it does not say anything that you can configure it.

    But it did say only this:

    *ARP packet viewer
    *Customized display of logged ARP packets

    And that's what it does,if it can be configured? I must have missed something.But I did check everything and no options to configure it.

    Hope that helps
     
    Last edited: Apr 19, 2006
  11. Devinco

    Devinco Registered Member

    Joined:
    Jul 2, 2004
    Posts:
    2,524
    It helps a lot and answers my question. Thanks Kush! :)
     
  12. Frederic

    Frederic LnS Developer

    Joined:
    Jan 9, 2003
    Posts:
    4,354
    Location:
    France
    Hi,

    If you want to create specific ARP packet filtering, the RawRuleEdition plugin probably could perhaps help you.

    Frederic
     
Thread Status:
Not open for further replies.