how to overcome NetCut? | Tech Off

Shark_M

Hello guys, if you are in a network using LAN, and someone uses NetCut
@ http://www.arcai.com/ to kill your ip, how to block that?

it uses ARP. I need a way to block it can you suggest a way?

jozjan
jozjan

If you have Cisco switches, then use Cisco port security features on your switches.

arcai

hi,

netcut 2.0 have protect arp spoof function , try that.

also, fyi. even cisco switch with secure port enabled, netcut 2.0 still works.

phreaks

Shark_M wrote:
Hello guys, if you are in a network using LAN, and someone uses NetCut
@ http://www.arcai.com/ to kill your ip, how to block that?

it uses ARP. I need a way to block it can you suggest a way?

1) Disable ICMP
2) arp -d * //In case you are already poisoned
3) enable MAC filtering on your router!
4) Finally add a static ARP table

arcai

hi phreaks
just curious that have you tried what you suggest ?

phreaks

arcai wrote:
hi phreaks
just curious that have you tried what you suggest ?

No, I already have static ARP entries and have never had to deal with netcut.

However, tuning off ICMP *should* limit the ability for netcut to obtain a list of IP's on your subnet and adding a static ARP entry(s) *should* disable the ability of ARP poisoning.

arcai

hi,

static ARP entries on your Own PC will not work , you have to make the static ARP entries on your gateway's ARP Table.

figuerres
???

Shark_M wrote:
Hello guys, if you are in a network using LAN, and someone uses NetCut
@ http://www.arcai.com/ to kill your ip, how to block that?

it uses ARP. I need a way to block it can you suggest a way?

who owns / admins the LAN?

if I found such a program on my network i'd publish a notice that such a program is not allowed and if found the user could face a writeup and or be fired if it continued to happen.

the other thing would be to find a way to locate the netcut pc and cut it off the network.

like this post says:

http://newsgroups.linuxbroker.com/index.php?tab=com&newsgroup=comp.os.linux.security&article=5694

find an arpwatch for win32 or use etherial and see who is effing with arp traffic!