»» SolidTrustPay Wajib Bagi Anda Pebisnis Online ««


»» SolidTrustPay must for your online business ««

▬▬▬▬▬▬▬▬▬ஜ۩۞۩ஜ▬▬▬▬▬▬▬▬▬▬
»» WELCOME to DOFOLLOW BLOGs "17 January 2012"««
»» Computer & Software Technology Sharing Information««
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ஜ۩۞۩ஜ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
  • How To Detect BadHost or Spoofer or ARP program (Including NetCut) in Mikrotik

    How To Detect BadHost or Spoofer or ARP program (Including NetCut) in Mikrotik

    This article i found on mikrotik forum and good for Administrator Network to handle any bad host spoofer as following my old post  cara menangkal netcut.

     

    Attempt to detect and Block Bad Hosts


    Network administrators are in a constant battle trying to keep attacks from virus infected computers, computers that have been taken over by malicious people and malicious people them selfs. It's a never ending barrage of attacks trying to exploit any flaw in your network possible. I keep a list of hosts/networks that I consider to be "bad-hosts", this is a manual built list and it works great but I don't always have time to sit and watch for candidates for this list, with small scripts as below :

    1. add the rule in the new terminal
    2. edit this rule by yourself
    3. remove all IPs from address list
    4. try to run Net Cut to find if the Microtik detected it or not

    first,add this code in the new terminal
    /ip firewall filter

    add action=reject chain=forward comment="Reject if in the 24-hour-list" disabled=no reject-with=icmp-network-unreachable src-address-list=24-hour-list

    add action=jump chain=forward comment="Check if dest is an open customer" disabled=no dst-address-list=open-customers jump-target=open-customers
    add action=jump chain=forward comment="Check Known Bad Hosts" disabled=no jump-target=bad-hosts
    add action=reject chain=forward comment="Reject if in the 24-hour-list" disabled=no reject-with=icmp-network-unreachable src-address-list=24-hour-list


    add action=return chain=bad-host-detection comment="Take no action on bogons" disabled=no src-address-list=bogons
    add action=add-src-to-address-list address-list=30-seond-list address-list-timeout=30s chain=bad-host-detection comment="Add to the 30 second list" disabled=no


    add action=add-src-to-address-list address-list=24-hour-list address-list-timeout="1d 00:00:00" chain=bad-host-detection comment="If seen 20 time in 30 seconds add to the one day block list" disabled=no nth=50 src-address-list=30-seond-list
    add action=return chain=bad-host-detection comment="" disabled=no


    add action=jump chain=forward comment="jump to the bad-host-detection chain" disabled=no jump-target=bad-host-detection src-address-list=!our-networks

    add action=jump chain=forward comment="jump to the bad-host-detection chain" disabled=no jump-target=bad-host-detection src-address-list=!our-networks
    add action=log chain=forward comment="log and reject the rest" disabled=no log-prefix=""
    add action=reject chain=forward comment="" disabled=no reject-with=icmp-network-unreachable



    2. Follow the next pic to edit this rule

    Image
    But change 192.168.0.0/24 to your network IP
    3. Remove all IPs from the network
    4. Try to run Net Cut

    After 10 seconds you will see the IP in the "30 seconds list"
    After 10 seconds you will see the IP in the "24 list"
    As you see the Microtik catch the IP he run net cut
    Notes : if you not using mangle you can remove "Nth options" from script. 
    Its worked properly in my network
    Source :
    1. http://forum.mikrotik.com/viewtopic.php?f=2&t=31384
    2. http://wiki.mikrotik.com/wiki/Bad-host-detection
    Keyword : Spoof, badhost, deteksi badhost, netcut, mikrotik

1 komentar:

  1. ahmadi says:

    Thanks i had use this and Worked... Nice post.

Penting Menurut Anda ? Bantu Sebarkan ...
  • Share
  • [i]
Warning :
This articles is the property of http://www.tambelanblog.com
Copying and publishing any articles from our site to your websites is strictly NOT allowed


Protected by Copyscape Online Plagiarism Check

#################################################


.::Latest Comments

Recent Comments Widget

.::Search On This Blog

.::About us : Do Follow Blog !!

TambelanBlog, Care to Shared Do Follow Blog

.::Media

.::Translate This Page

Arabic Korean Japanese Chinese Simplified Russian Portuguese
English French German Spain Italian Dutch

.::Subscribe Now For Free

Our Readers

Your email here

Received Update for FREE:

Delivered by FeedBurner

.::Be My Circles

.::Popular Post by Readers

.::Follower to be Followed!

.::First Class Exchange Link!