Use the ARP firewall to detect LAN ARP attacks

Some time ago, our company was also attacked, the reason is that the employee received and clicked on the virus, which once paralyzed the company's intranet.

1.Find the original attack address, this is very simple, you can get it with a ping, and limit it on the router.

Viruses will definitely have virus sources in the LAN, find them (some routes will have relevant logs, if not, you have to observe carefully, 360 has ARP's firewall, you can intercept it, and find the source of the virus), unplug these machine network cables, and use free killing software to kill these viruses, such as Keniu, Jinshan can be.

3.The router is limited to prevent ARP spoofing and the like.

4.Frequently scan your own network, IP and Mac are best bound, so that problems can be solved.

5.Promote more network knowledge, not everyone knows what a virus is, and the mouse is always messy.

It should be attacking your network card address!

360 can't prevent it?

Let me teach you how to prevent ARP attacks.

Here are some things we can do to protect against ARP spoofing.

arp -d * (clear the erroneous arp table first).

arp -s 03-03-03-03-03-03-03 (statically specifies the MAC address of the gateway).

2) Statically bind the port to the MAC address on the switch.

3) Do a static binding of IP address and MAC address on the router.

4) Use "ARP Server" to broadcast the correct IP-MAC mapping table for all hosts in the network segment at certain intervals.

5) The most important thing is to improve the security awareness of users and develop good security habits, including: timely installation of system patches; Set a strong password for the system; install firewalls; Install effective anti-virus software and update the virus database in a timely manner; Don't actively carry out cyber attacks and don't run untrusted software.

It is recommended that you try it with an immunity wall, which can solve the ARP problem and find the source of the attack.

Hello landlord, I think you want to know more about how to prevent ARP attacks, right?

When an ARP attack is an attack on you by other hosts in the LAN, it mainly sends a false amount of data to occupy bandwidth, resulting in slow or no network speed for other hosts in the network, and sometimes it can even send Trojan viruses through ARP attacks, so you have to guard against it.

The following is a list of solutions based on my experience;

1.Install 360 Security Guard, click "Trojan Firewall" -- Settings -- ARP Firewall Settings -- Manually Set Gateway DNS and then enter your IP and MAC address into it, click Save, and then restart the computer. A normal attack 360 can do it.

2.The more professional ones are Kingsoft Baker ARP firewall, which is more intelligent and can automatically collect IP information, and the effect is also good!

3.There's also the Shadow Firewall, which looks a little more intuitive and can scan all the hosts in the network.

The above software is recommended to go to the Sky and Pacific Software Station** to ensure its safety. The ARP attack was so powerful that these tools had to be used. That's how I am, and it's rare to be able to attack me now.

Hope it helps!