Is it possible to block arp request? If yes, how?
If I can block arp request, does it mean that other machines in same network cannot find my machine?
7
-
5Anything is possible. You do realize ARP is a fundamental part of ethernet, right?– RickyJan 1, 2016 at 4:03
-
Can you be more specific where you would want to block an ARP request? Firewall, client, ... ? If you are talking about a client, then you should read the already given answer(s) here.– BulkiJan 18, 2016 at 23:03
-
2Can you share the reason why you would want to block ARP requests?– EvertonJan 26, 2016 at 12:11
-
@RickyBeam I also have same question. I know blocking any ARP is a foolish idea. I just want to use whitelisting/blacklisting. Block any host except gateway. Home networking is off topic here. So, I didn't post the question here. I posted it here. It would be helpful if you kindly take a look. thanks– Sourav GhoshFeb 28, 2017 at 9:30
-
@Bulki ^ same request. please see my previous comment– Sourav GhoshFeb 28, 2017 at 9:32
|
Show 2 more comments
3 Answers
Yes, it is possible. I'm not sure if you can block only ARP requests, but as far as I know this command would block all ARP (incoming and outgoing). It's just for Linux systems:
ip link set dev eth0 arp off
No, blocking ARP requests doesn't mean that other hosts won't find you, it means that you won't find other hosts (note that I'm talking from your host point of view, so the requests are going out not going in).
-
1You should point out that this is specific to an OS, which may not be the OS for the question..– Ron Maupin ♦May 1, 2016 at 20:51
-
If you are looking for isolation between the desktops and only communicate with your gateway/router, investigate PVlans (private vlans):- https://en.wikipedia.org/wiki/Private_VLAN
-
This is a great interpretation of the potential reasons behind the original question. I would like to add that you can also isolate wireless clients on the same network (AP client isolation). May 2, 2016 at 14:18
I don't think you understand what ARP does and the implications of disabling it. The only thing ARP does is to let a host (including your gateway, which is really just another host as far as the LAN is concerned) relate a layer-3 address to the layer-2 address.
If you disable your PC's ability to respond to ARP requests, you will essentially isolate your PC. Yes, you could still send ethernet frames out, but you wouldn't receive anything except for broadcasts and unknown unicasts. Much of networking uses request/response which would be disabled. Your gateway couldn't even find you, so something as simple as surfing the Internet would not work.
Disabling your PC's response to ARP requests will probably require you create custom software, and you may as well just disconnect the ethernet cable.
answered Jan 1, 2016 at 7:21
-
1*cough*static arp entries*cough* ARP isn't necessary for communication on ethernet. ARP is simply the way IP hosts learn what ethernet node wants the traffic. (see also: proxy-arp) If you disable ARP, that automatic learning can't happen; so you have to explicitly configure that information.– RickyJan 2, 2016 at 0:54
-
1Static ARP could be used on the PC, but if other hosts can't learn the PC's MAC address because it wants to be invisible, it can't get any traffic back. Using static ARP pointing to it on the other hosts defeats the purpose to be invisible.– Ron Maupin ♦Jan 2, 2016 at 1:24
-
2Static ARP means you manually tell every device on the network about every device on the network. A new "rogue" device won't have that knowledge, and thus, won't be able to find anything (unless it leaks it's presence -- e.g. via broadcast) If you don't want "A" to know about "B" (and v.v.) then you don't add their MACs. I'm right there with you on it being the stupidest "security" imaginable.– RickyJan 3, 2016 at 4:54