I have a dedicated root server. I noticed strange connections from 255.255.255.255 in iftop. Because of that i tried to investigate it. I runned the following command: tcpdump -i eth0 ether broadcast and ether multicastHere i get about 100 requests per second16:21:13.174056 ARP, Request who has ****** tell ***** length 4616:21:13.174406 ARP, Request who has ****** tell ***** length 4616:21:13.174717 ARP, Request who has ****** tell ***** length 4616:21:13.175351 ARP, Request who has ****** tell ***** length 4616:21:13.175772 ARP, Request who has ****** tell ***** length 4616:21:13.175923 ARP, Request who has ****** tell ***** length 4616:21:13.250028 ARP, Request who has ****** tell ***** length 4616:21:13.261960 ARP, Request who has ****** tell ***** length 4616:21:13.334608 ARP, Request who has ****** tell ***** length 4616:21:13.360883 ARP, Request who has ****** tell ***** length 4616:21:13.361910 ARP, Request who has ****** tell ***** length 4616:21:13.361919 ARP, Request who has ****** tell ***** length 4616:21:13.363287 ARP, Request who has ****** tell ***** length 4616:21:13.363297 ARP, Request who has ****** tell ***** length 4616:21:13.365008 ARP, Request who has ****** tell ***** length 4616:21:13.462835 ARP, Request who has ****** tell ***** length 4616:21:13.464375 ARP, Request who has ****** tell ***** length 4616:21:13.464954 ARP, Request who has ****** tell ***** length 4616:21:13.565233 ARP, Request who has ****** tell ***** length 4616:21:13.566120 ARP, Request who has ****** tell ***** length 4616:21:13.567008 ARP, Request who has ****** tell ***** length 46This looks not normal to me. There are many request from different IP-Adresses. Here is one example (domain is censored):16:21:13.334608 ARP, Request who has mysql.example.com tell web1.example.com length 46So web1.example.com is sending a request which Machine/Mac-Adress is responsible for hostname mysql.example.com. When i am correct i can now do ARP-Spoofing and tell web1.example.com that my Server is responsible for mysql.example.com.. So it's a man in the middle attack...I have this problem only with one server at one provider. I never had that before. My colleague thinks also that it's a security risk / misconfiguration of router/switch in the datacenter..Next strange thing: When i run commandarpwithout any parameters i got a list with 20 different hostnames and mac adresses. I have different servers, also at other providers. When i run those commands on my other servers i don't get any ARP Request and i only see my machine when i run arp without any argument... So what the heck is going on here?
ARP Spoofing in Data Center
security;arp
255.255.255.255 is not strange, it's an IPv4 broadcast address, and is used by various protocols. ARP spam may appear when there are network problems, or I've also seen it under normal circumstances; without knowing which IP addresses (are they gateway routers?) and the configuration of such, the traffic may or may not be nefarious. Talk to the networking team?ARP spoofing can be a problem if there is someone naughty on the local subnet, though can be mitigated by appropriate network technology (802.1X, or locking particular MAC to particular network ports). But that's more a networking question. On the unix side, one can make static arp entries, though that may cause unexpected breakage if not coordinated with the network group or other teams.arp will show hosts that have chatted up the system somehow, if a system shows none, then it may be on a subnet where broadcast spam is not common (e.g. a server-only network with services locked down, so no dynamic DNS or whatnot), or it could be a virt protected from broadcast traffic due to how that virt is networked.