arpon

arpon(8)                     System Manager's Manual                    arpon(8)



NAME
       ArpON - ARP handler inspection

IMPORTANT NOTICE
       Since ArpON 3.0-ng (next generation), ArpON has been rewritten from
       scratch, therefore all the old versions of ArpON (lower of 3.0-ng) are
       deprecated. Please upgrade all installations of ArpON and read carefully
       the documentation specified below and this man page of ArpON.

SYNOPSIS
       arpon [OPTIONS] [SARPI DARPI HARPI]

DESCRIPTION
       ArpON (ARP handler inspection) is a Host-based solution that make the ARP
       standardized protocol secure in order to avoid the Man In The Middle
       (MITM) attack through the ARP spoofing, ARP cache poisoning or ARP poison
       routing attack.

       This is possible using three kinds of anti ARP spoofing techniques:

       1) SARPI (Static ARP Inspection) for the statically configured networks
       without DHCP;
       2) DARPI (Dynamic ARP Inspection) for the dynamically configured networks
       with DHCP;
       3) HARPI (Hybrid ARP Inspection) for the statically and dynamically
       configured networks with DHCP.

       The goal of ArpON is therefore to provide a secure and efficient network
       daemon that provides the SARPI, DARPI and HARPI anti ARP spoofing
       technique, thus making the ARP standardized protocol secure from any
       foreign intrusion.

       ArpON sets of policies in the ARP cache for all the static and or dynamic
       entries matching the specified network interface (or that matching the
       several specified network interfaces if run concurrently several daemons
       of ArpON for different network interfaces), through the run of SARPI,
       DARPI or HARPI anti ARP spoofing technique.

       ArpON have to be run with the root privileges. ArpON have to be
       configured using command-line options and a configuration file. ArpON
       reloads the configuration of the specified network interface and rereads
       its configuration file when it receives a hangup signal (SIGHUP) by
       executing itself with the name and options it was started with. ArpON
       exits correctly when it receives an interrupt signal (SIGINT) or a
       termination signal (SIGTERM).

IMPORTANT NOTE
       The ArpON daemon sets two fundamental kernel network parameters via the
       sysctl interface on the specified network interface:

       1) The arp_ignore kernel parameter of the specified network interface is
       always setted to 8 by ArpON. This is done to disable, in the specified
       network interface of the Operating System, the sending of the ARP replies
       in response to received ARP requests for all local addresses (the ARP
       replies on the specified network interface, will be sent by ArpON instead
       of the Operating System).

       2) The arp_accept kernel parameter of the specified network interface is
       always setted to 0 by ArpON. This is done to disable, in the specified
       network interface of the Operating System, the creating of the new IP
       entries in the ARP cache triggered by the unsolicited and gratuitous ARP
       requests and replies (the IP entries in the ARP cache on the specified
       network interface, will be created or updated by ArpON as static or
       dynamic IP entries instead of the Operating System).

       The ArpON daemon restores the previously values read from the arp_ignore
       and arp_accept kernel parameters of the specified network interface when
       it receives an interrupt signal (SIGINT) or a termination signal
       (SIGTERM). Remember to restore the values of the arp_ignore and
       arp_accept kernel parameters of the specified network interface (the
       default values are 0 for both), if you have terminated the ArpON daemon
       with other signals, e.g. kill signal (SIGKILL).

OPTIONS SUMMARY
       The available options are:

       GENERAL OPTIONS

       -d (--daemon)
              Daemonize the ArpON.

       -i (--interface) <interface>
              Use the specified network interface.

       SARPI 'STATIC ARP INSPECTION' OPTION

       SARPI anti ARP spoofing technique manages and sets the policies in the
       ARP cache only for all the static entries matching the specified network
       interface, in order to avoid the Man In The Middle (MITM) attack through
       the ARP spoofing, ARP cache poisoning or ARP poison routing. Therefore
       SARPI is an optimal choice in those statically configured networks
       without DHCP. SARPI sets these policies:

       1) CLEAN: SARPI cleans from the ARP cache only all the entries matching
       the specified network interface, that are present or not present in the
       configuration file;
       2) UPDATE: SARPI updates in the ARP cache only all the static entries
       matching the specified network interface, that are present in the
       configuration file;
       3) REFRESH: SARPI refreshes in the ARP cache only a static entry matching
       the specified network interface, that is present in the configuration
       file;
       4) ALLOW: SARPI sets up in the ARP cache only a dynamic entry matching
       the specified network interface, that is not present in the configuration
       file.

       Therefore SARPI requires a specified network interface and the
       specification in the configuration file of the ARP cache only for all the
       static entries matching the specified network interface.

       -S (--sarpi)
              Run SARPI anti ARP spoofing technique.

       DARPI 'DYNAMIC ARP INSPECTION' OPTION

       DARPI anti ARP spoofing technique manages and sets the policies in the
       ARP cache only for all the dynamic entries matching the specified network
       interface, in order to avoid the Man In The Middle (MITM) attack through
       the ARP spoofing, ARP cache poisoning or ARP poison routing. Therefore
       DARPI is an optimal choice in those dynamically configured networks with
       DHCP. DARPI sets these policies:

       1) CLEAN: DARPI cleans from the ARP cache only all the entries matching
       the specified network interface;
       2) ALLOW: DARPI sets up in the ARP cache only a dynamic entry matching
       the specified network interface;
       3) DENY: DARPI cleans up from the ARP cache only a dynamic entry matching
       the specified network interface.

       Therefore DARPI requires a specified network interface and it doesn't
       requires any specification in the configuration file of the ARP cache
       only for all the dynamic entries matching the specified network
       interface.

       -D (--darpi)
              Run DARPI anti ARP spoofing technique.

       HARPI 'HYBRID ARP INSPECTION' OPTION

       HARPI anti ARP spoofing technique manages and sets the policies in the
       ARP cache for both all the static and dynamic entries matching the
       specified network interface, in order to avoid the Man In The Middle
       (MITM) attack through the ARP spoofing, ARP cache poisoning or ARP poison
       routing. Therefore HARPI is an optimal choice in those statically and
       dynamically configured networks with DHCP. HARPI sets and combines these
       policies of the SARPI and DARPI:

       1) CLEAN: HARPI cleans from the ARP cache only all the entries matching
       the specified network interface, that are present or not present in the
       configuration file;
       2) UPDATE: HARPI updates in the ARP cache only all the static entries
       matching the specified network interface, that are present in the
       configuration file;
       3) REFRESH: HARPI refreshes in the ARP cache only a static entry matching
       the specified network interface, that is present in the configuration
       file;
       4) ALLOW: HARPI sets up in the ARP cache only a dynamic entry matching
       the specified network interface, that is not present in the configuration
       file;
       5) DENY: HARPI cleans up from the ARP cache only a dynamic entry matching
       the specified network interface, that is not present in the configuration
       file.

       Therefore HARPI requires a specified network interface, the specification
       in the configuration file of the ARP cache only for all the static
       entries matching the specified network interface; instead it doesn't
       requires any specification in the configuration file of the ARP cache
       only for all the dynamic entries matching the specified network
       interface.

       -H (--harpi)
              Run HARPI anti ARP spoofing technique.

       STANDARD OPTIONS

       -v (--version)
              Print the version and exit.

       -h (--help)
              Print the help screen and exit.

FILES
       The available files are:

       /etc/arpon.conf
              The configuration file contains the configuration data of ArpON
              and it is used when run the SARPI or HARPI anti ARP spoofing
              technique, for the specification in the ARP cache only for all the
              static entries matching the specified network interface (or that
              matching the several specified network interfaces if run
              concurrently several daemons of ArpON for different network
              interfaces). This file should be writable by root only but it is
              recommended (though not necessary) that it be world-readable.

       /var/log/arpon.log
              The log file contains the log data of ArpON. If there are several
              daemons of ArpON running concurrently for different network
              interfaces, this contains the log data of all the daemons of
              ArpON. This file should be readable only by root, and need not be
              readable by anyone else.

       /var/run/arpon.pid
              The pid file contains the process ID of ArpON. If there are
              several daemons of ArpON running concurrently for different
              network interfaces, this contains the process ID of the one
              started last. The content of this file is not sensitive; it can be
              world-readable.

EXAMPLES
       These examples shows how to use all three kinds of anti ARP spoofing
       techniques.

       In the same host, we have three network interfaces with different subnet
       classes and we would set the ARP cache for all the static and dynamic
       entries matching the eth0, wlan0 and eth1 network interfaces. This
       scenario requires the run concurrently of three daemons of ArpON:

       SARPI 'STATIC ARP INSPECTION' EXAMPLE

       The eth0 network interface has the 192.168.1.2/24 IP address. We have
       only three static entries of the ARP cache:

       1) 192.168.1.1 at 58:ac:78:10:b9:77;
       2) 192.168.1.3 at d4:be:d9:fe:8b:45;
       3) 192.168.1.4 at 90:94:e4:bb:1c:10.

       and we have no dynamic entries of the ARP cache. This is the ideal case
       where we have to use the SARPI anti ARP spoofing technique, therefore
       specify in the configuration file of the ARP cache only all the static
       entries matching the eth0 network interface:

              $ sudo nano /etc/arpon.conf

       Therefore:

              #
              # ArpON configuration file.
              #
              # See the arpon(8) man page for details.
              #

              #
              # Static entries matching the eth0 network interface:
              #
              # First static entry:
              192.168.1.1     58:ac:78:10:b9:77
              # Second static entry:
              192.168.1.3     d4:be:d9:fe:8b:45
              # Third static entry:
              192.168.1.4     90:94:e4:bb:1c:10

       Daemonize the ArpON and run SARPI anti ARP spoofing technique on the eth0
       network interface:

              $ sudo arpon -d -i eth0 -S

       Read the log file:

              $ sudo tail -f /var/log/arpon.log

       Read the pid file:

              $ cat /var/run/arpon.pid

       DARPI 'DYNAMIC ARP INSPECTION' EXAMPLE

       The wlan0 network interface has the 172.16.1.2/24 IP address. We have no
       static entries of the ARP cache, and we have only dynamic entries of the
       ARP cache. This is the ideal case where we have to use the DARPI anti ARP
       spoofing technique, therefore daemonize the ArpON and run DARPI anti ARP
       spoofing technique on the wlan0 network interface:

              $ sudo arpon -d -i wlan0 -D

       Read the log file:

              $ sudo tail -f /var/log/arpon.log

       Read the pid file:

              $ cat /var/run/arpon.pid

       HARPI 'HYBRID ARP INSPECTION' EXAMPLE

       The eth1 network interface has the 10.0.1.2/16 IP address. We have only
       two static entries of the ARP cache:

       1) 10.0.1.1 at 58:ac:78:88:1a:bb;
       2) 10.0.10.1 at 90:94:e4:7e:f4:59.

       and we have the rest of entries as dynamic entries of the ARP cache. This
       is the ideal case where we have to use the HARPI anti ARP spoofing
       technique, therefore specify in the configuration file of the ARP cache
       only all the static entries matching the eth1 network interface:

              $ sudo nano /etc/arpon.conf

       Therefore:

              #
              # ArpON configuration file.
              #
              # See the arpon(8) man page for details.
              #

              #
              # Static entries matching the eth0 network interface:
              #
              # First static entry:
              192.168.1.1     58:ac:78:10:b9:77
              # Second static entry:
              192.168.1.3     d4:be:d9:fe:8b:45
              # Third static entry:
              192.168.1.4     90:94:e4:bb:1c:10

              #
              # Static entries matching the eth1 network interface:
              #
              # First static entry:
              10.0.1.1        58:ac:78:88:1a:bb
              # Second static entry:
              10.0.10.1       90:94:e4:7e:f4:59

       Daemonize the ArpON and run HARPI anti ARP spoofing technique on the eth1
       network interface:

              $ sudo arpon -d -i eth1 -H

       Read the log file:

              $ sudo tail -f /var/log/arpon.log

       Read the pid file:

              $ cat /var/run/arpon.pid

DOCUMENTATION
       Please see also the documentation file:

              /usr/share/doc/arpon/index.html

       It contains the retrieving tutorial; the building tutorial; the
       installation tutorial; the user tutorial with many examples and
       scenarios; the development tutorial with the Activity diagrams of the
       SARPI, DARPI and HARPI anti ARP spoofing technique and with modular
       source code well commented; the bug report tutorial that takes you step-
       by-step through all of the features of ArpON.

DEVELOPMENT AND BUGS
       Please send questions, desirable enhancements, patch, source code
       contributions, problems, bugs, etc... to author or via the Bug tracking
       system, as specified in the documentation file specified above and in the
       official website:

              http://arpon.sourceforge.net

AUTHOR
       ArpON was writen by Andrea Di Pasquale aka "spikey"
       <spikey.it@gmail.com>.

COPYRIGHT AND LICENSING
       Copyright (C) 2008-2016 Andrea Di Pasquale <spikey.it@gmail.com>
       All rights reserved.

       Redistribution and use in source and binary forms, with or without
       modification, are permitted provided that the following conditions are
       met:

       1. Redistributions of source code must retain the above copyright notice,
       this list of conditions and the following disclaimer.

       2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.

       THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
       IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
       OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
       IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
       INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
       SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
       HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
       STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
       ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
       POSSIBILITY OF SUCH DAMAGE.

NOTES
       The ArpON daemon is completely compatible with the ARP standardized
       protocol as described in these official RFC documents:

       1. RFC 826:
              http://tools.ietf.org/html/rfc826

       2. RFC 2131:
              http://tools.ietf.org/html/rfc2131

       3. RFC 3927:
              http://tools.ietf.org/html/rfc3927

       4. RFC 5227:
              http://tools.ietf.org/html/rfc5227

       The ArpON daemon sets the arp_ignore and the arp_accept fundamental
       kernel network parameters via the sysctl interface as described in this
       official kernel document:

       1. IP sysctl:
              http://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt




ArpON 3.0-ng                     29 January 2016                        arpon(8)