Re[2]: ARP poisonong. LIVE_MAC

2004-02-04 Thread Derek Marcotte
In-Reply-To: [EMAIL PROTECTED]

You want to deny physical connectivity to the LAN, from a
particular host, period.

You might try setting up a quasi-switch with bridge (kernel
option see LINT), plug a whole bunch of network cards in, and
downing the interfaces when they don't pay... It would be a full
duplex, dual speed-hub, which is probably fine, anyways... You'd
also need cross-over cables for all of the PCs becuase it's a
HOST to HOST connection.  I'd recommend the DLink DFE-570TX, but
I don't know that they make it anymore... Intel makes some good
multi-port adapters.  Also a PCI bus is limited to pushing 1056
Mbps (32-bits * 33Mhz), so you can really max out your system
(potentially 200Mbps/adapter) quickly...

The best option would be to go with something that is designed
for this sort of thing.  A Cisco catalyst (1900s and 2900s are
pretty cheap these days) is.  You can write a script that logs
into the switch, and ups and downs the port when they don't pay,
or their account is up to date.

Just a thought...  A dedicated switch would probably be the best
way to deal with this, since you are switching the traffic
anyways.

Alternatively, you can mess with ports/net/nemesis to craft ARP
packets, and so can the connected device, because they still have
physical access to the LAN.  Not to mention that they are still
capable of denying service to other customers via the exact same
method that you use, even though they are disabled.

Cheers,
Derek

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re[2]: ARP poisonong. LIVE_MAC

2004-01-26 Thread Alexey Kuzmenko
Hello Lowell,

Saturday, January 24, 2004, 5:20:13 PM, you wrote:

 replies for restricted host causing these hosts (basically windows) not
 to work in the LAN.
LG What an incredibly ugly idea.

Why it's ugly?. Imagine that You've built a LAN to provide this
service to customers (each PC is a separate customer, service is LAN). But all LAN has
no L3 switches to cut off some customer that didn't pay for the
service.

How do you plan to cut off customers in debts?

 I'm wandering if there is something like above but for FreeBSD. I need
 to disallow any host network activity from the server (FreeBSD 4.8)

LG Surely there's a better way to implement what you're actually trying
LG to do; like firewalling the server you don't want accessed.

See above. I do not want to firewall some server! I have a sevice -
LAN connection, and I want to cut off some users that have debts
(There is a hardware solution - just unplug them from the switch, but
I'm seeking for software solution)


-- 
Alexey Kuzmenko
CCNA
System Administrator
UN House in Ukraine

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]