Subject: Re: [Mud] Simplified Quarantine model

From: Michael Richardson <[email-masked]>
Date: Tue, 23 Jul 2019 19:07:34 -0400

tirumal reddy <[email-masked]> wrote:
    > How do you identify an attacker is using the victim device's MAC and IP
    > address to send attack traffic (e.g. SYN flood) ?

On wired, this has to be protected by using a managed switch and
then locking ports down to mac addresses.

On wireless, one needs unique PSKs (or Enterprise WPA), which then one can
identify which device is which, and lock the MAC address down.

Of course, all this fails if the devices are expected to randomize the L2
address.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: tirumal reddy <[email-masked]>
Date: Wed, 24 Jul 2019 11:25:50 +0530

> Of course, all this fails if the devices are expected to randomize the L2

Yes, the problem is in Home networks and Enterprise networks already use
various techniques to detect MAC spoofing.

-Tiru