[SOLVED] iptables: block long spoofed MAC

huuan · Last edited by huuan on Fri Jul 31, 2009 12:38 am; edited 1 time in total

I'm trying to drop the scans from our local net ops security so they don't fill up the server log.

I enabled MAC address filtering but net ops seems to use a fake MAC which is longer than normal and as a result iptables doesn't match it.
The only thing common with the net ops scans is the MAC as they use a variety of random source IP addresses and ports.

Here's a typical firewall log entry when they scan:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23093

After a bit of analysis, it appears that the kernel prints the entire Ethernet header and calls it MAC. Therefore, you get the MAC address of the recipient, the MAC address of the sender, and the 16 bit protocol (08:00 = IPv4) in the field labeled MAC. Try writing your rule to match 00:90:92:ab:ec:00, since that is the sending MAC address according to the sample you posted.

huuan · Posted: Wed Feb 20, 2008 3:00 am Post subject:

A message like yours is why I love Gentoo. The support here is awesome!

Thanks for the insight. I've updated my iptables script and restarted the firewall, it should be really obvious by tomorrow if it worked (which I expect it will). I'll report the success here tomorrow. You rule.

Thanks

[edit] Feb 20,2008: Works a treat, thanks!