[nsp-sec] How to hijack traffic for an entire Content/Ad Company - ARP Poisoning revisited - 8800.org / 6600.org badness

[Florian Weimer]

* Chris Morrow:

> so.. port-security is a solved problem for datacenters no??

Port security does not stop ARP cache poisoning.  You also need static
ARP tables on all nodes within the same broadcast domain.  It's
usually easier to give a dedicated IP layer interface to each host.
In many environments, it's a challenge to implement that.

I still don't get why IEEE insists on emulating shared media networks.
Probably, We'll still end up running ARP on 100GE networks. *sigh*

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99