Sun Solaris System Admin » ARP http://www.sunsolarisadmin.com Sun Solaris HowTo's Tips Tricks Tutorials Wed, 21 Sep 2011 19:57:59 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 http://www.sunsolarisadmin.com http://www.sunsolarisadmin.com/wp-content/mbp-favicon/favicon.ico Sun Solaris System Admin Increase/Decrease route flushing time period in Solaris http://www.sunsolarisadmin.com/networking/increasedecrease-route-flushing-time-period-in-solaris/?utm_source=rss&utm_medium=rss&utm_campaign=increasedecrease-route-flushing-time-period-in-solaris http://www.sunsolarisadmin.com/networking/increasedecrease-route-flushing-time-period-in-solaris/#comments Thu, 24 Apr 2008 19:08:05 +0000 admin http://www.sunsolarisadmin.com/networking/increasedecrease-route-flushing-time-period-in-solaris/ [...]]]>

Just as we saw modifying the caching time for ARP entries in the ARP table here. We can modify the default time that a sun Solaris system can hold the routing entries.

The default time for which a dynamically learnt Route entry in the routing table is 20mins (1200000ms)

To Display current Route holding time

To display the current time interval to hold a route entry

In Solaris 8/9/10

sunsolaris# ndd -get /dev/ip ip_ire_arp_interval
1200000

In earlier versions to Solaris 8

sunsolaris# ndd -get /dev/ip ip_ire_flush_interval

To modify the Route holding time 

This can be modified or reduced to a lower level. To modify the default time to say 15 mins

In Solaris 8/9/10

sunsolaris# ndd -set /dev/ip ip_ire_arp_interval 900000

In earlier versions to Solaris 8

sunsolaris# ndd -set /dev/ip ip_ire_flush_interval 900000

]]> http://www.sunsolarisadmin.com/networking/increasedecrease-route-flushing-time-period-in-solaris/feed/ 0 Display/Add/Delete/modify ARP entries in ARP Table http://www.sunsolarisadmin.com/networking/displayadddeletemodify-arp-entries-in-arp-table/?utm_source=rss&utm_medium=rss&utm_campaign=displayadddeletemodify-arp-entries-in-arp-table http://www.sunsolarisadmin.com/networking/displayadddeletemodify-arp-entries-in-arp-table/#comments Thu, 24 Apr 2008 18:42:50 +0000 admin http://www.sunsolarisadmin.com/networking/displayadddeletemodify-arp-entries-in-arp-table/ [...]]]>
Not so often we would end up troubleshooting or manipulating ARP and ARP tables in Sun Solaris. However, following are some of the useful commands which can help when required. The following commands will help you display,modify,add,delete ARP entries in Sun Solaris ARP table.

Display ARP table

sunsolaris# arp -a
Net to Media Table: IPv4
Device   IP Address               Mask      Flags   Phys Addr
—— ——————– ————— —– —————
pcn0   192.168.0.1          255.255.255.255       00:18:4d:f8:a4:6e
pcn0   192.168.0.2          255.255.255.255       00:13:ce:85:0e:e1
pcn0   sunsolaris            255.255.255.255 SP    00:0c:29:d3:76:89
pcn0   BASE-ADDRESS.MCAST.NET 240.0.0.0       SM    01:00:5e:00:00:00

Delete an ARP entry

sunsolaris# arp -d 192.168.0.1
192.168.0.1 (192.168.0.1) deleted

To verify the entry indeed is deleted

sunsolaris# arp -a
Net to Media Table: IPv4
Device   IP Address               Mask      Flags   Phys Addr
—— ——————– ————— —– —————
pcn0   192.168.0.2          255.255.255.255       00:13:ce:85:0e:e1
pcn0   solaris10            255.255.255.255 SP    00:0c:29:d3:76:89
pcn0   BASE-ADDRESS.MCAST.NET 240.0.0.0       SM    01:00:5e:00:00:00

You can see the ARP entry for 192.168.0.1 is longer found.

Add a Static entry

sunsolaris# arp -s 192.168.0.1 00:18:4d:f8:a4:6e

Syntax is

arp -s HOSTNAME MAC-Address <pub/temp/trail>

where

pub – publishes the ARP entries to other hosts on the network

temp – Temporary entry

trail – Allows Trailer Encapsulations to be sent to host

You can also read static entries from a file. This can come handy if you decide that all ARP entries are static and no ARP requests are sent and received from the system. You can add the static entries onto a file and add the arp command onto the network init scripts in /etc/rc2.d/

To read from file

sunsolaris# arp -f /etc/host_mac

where /etc/host_mac is my file name from where the ARP entries are read.

To check the current ARP caching time

sunsolaris# ndd -get /dev/arp arp_cleanup_interval
500000

where 500000 in milliseconds indicates 5mins

To modify ARP Cache timing, click here

]]> http://www.sunsolarisadmin.com/networking/displayadddeletemodify-arp-entries-in-arp-table/feed/ 6 Reduce ARP caching time in Sun Solaris using ndd http://www.sunsolarisadmin.com/security/reduce-arp-caching-time-in-sun-solaris-using-ndd/?utm_source=rss&utm_medium=rss&utm_campaign=reduce-arp-caching-time-in-sun-solaris-using-ndd http://www.sunsolarisadmin.com/security/reduce-arp-caching-time-in-sun-solaris-using-ndd/#comments Thu, 24 Apr 2008 18:02:40 +0000 admin http://www.sunsolarisadmin.com/security/reduce-arp-caching-time-in-sun-solaris-using-ndd/ [...]]]>
ARP attacks are the easiest attacks that can be launched on a network or a Server causing a Denial of Service. One of those things that can be done on the Sun Solaris Operating System is to alter the caching time for the ARP cache whch reduces the time that a rogue ARP entry stays in the ARP table. While this is not fool proof but can certainly make it that extra difficult to the hacker.

The default time that ARP entries are cached in a Sun Solaris system is 5 mins.

However, this can be reduced to lower level (say 3mins). This means that the number of ARP requests and ARP replies to and from the server will increase as a result. So, before modifying the caching time, check if this can cause andy congestion on your network.

To set the ARP cache time period

solaris# ndd -set /dev/arp arp_cleanup_interval 180000

The above command sets the interval to 3 minutes (1min is equal to 60000ms). Now, all the ARP entries are flushed at a faster rate (every 3mins)

For this change to persist across reboots, add this command onto the init scripts in /etc/rc2.d directory for your network interface (where all the required ndd commands are run).

]]> http://www.sunsolarisadmin.com/security/reduce-arp-caching-time-in-sun-solaris-using-ndd/feed/ 1