Binding IP and MAC Addresses on Linux to Prevent ARP Attacks

On a LAN, ARP (Address Resolution Protocol) is the basic protocol that maps IP addresses to MAC addresses, but it has no authentication — any host can claim to be any IP. This built-in "trust" is exactly what feeds many LAN attacks.

How ARP spoofing works

Let's start with the attack mechanics. On a LAN, hosts use ARP to resolve IP addresses to MAC addresses. Normally the gateway broadcasts a reply: "192.168.1.1 is at aa:bb:cc:dd:ee:ff". An attacker skips the rules and answers first with a forged reply: "192.168.1.1 is at <attacker's MAC>". The switch then forwards traffic meant for the gateway to the attacker, and a man-in-the-middle position is established.

A classic case: a shared office server whose gateway entry is spoofed. All inbound and outbound traffic passes through the attacker, exposing passwords, session cookies, and cleartext protocol content. Even with no sensitive data, such an attack causes link flapping that looks like a network outage and is exhausting to troubleshoot.

Static binding: lock IP to MAC

The defense is straightforward: pin the IP-to-MAC mapping for critical targets (gateway, DNS, database servers) so those ARP entries are static (PERM) and no longer accept updates broadcast on the wire — forged replies simply lose effect.

When binding is needed

The criterion is simple: if you share a layer-2 network (the same switch or subnet) with others, and untrusted devices exist there — employee laptops, customer-brought devices in an office network — binding is worth doing. Protect the gateway, DNS, file servers, and databases first. Cloud servers are usually exempt because tenants are isolated by virtualization, but mixed server rooms and self-managed office servers benefit a lot.

To be clear, static binding only treats the symptom: it protects the segment between the host and the gateway, but cannot stop a gateway impersonated by another host or re-learning after the ARP table is cleared. A more robust approach is enabling DHCP Snooping and DAI on the switch to drop forged ARP frames at the source.

1. Immediate Binding Command

arp -s 192.168.1.1 a1:d0:00:a3:30:08

This binds IP 192.168.1.1 to MAC a1:d0:00:a3:30:08 and takes effect immediately. Note that binding does not affect normal communication — traffic to that IP still uses the original physical link; it simply stops accepting forged updates. Some distributions have replaced arp with ip neigh; the two are equivalent. Modern systems also support the ip command:

ip neigh add 192.168.1.1 lladdr a1:d0:00:a3:30:08 nud permanent

2. Auto-Bind at Boot

Static entries are lost after a reboot, so write them into a boot script. On CentOS/RHEL, edit /etc/rc.local:

vi /etc/rc.local

Add the following content:

arp -s 192.168.1.1 a1:d0:00:a3:30:08

After saving, make sure /etc/rc.local has execute permission (some systems do not grant it by default):

chmod +x /etc/rc.local

On systemd systems, /etc/rc.local is managed by rc-local.service, so also make sure the service is enabled:

systemctl enable rc-local

Besides rc.local, you can also put the binding into the network interface configuration so it re-runs every time the NIC comes up. On Debian/Ubuntu add a post-up hook in /etc/network/interfaces; on CentOS append a command line at the end of /etc/sysconfig/network-scripts/ifcfg-eth0. The effect is equivalent and does not depend on whether rc-local.service starts, which suits setups with strict boot-order requirements.

3. Verify the Binding

arp -n

The corresponding entry will show a PERM (permanent) flag, meaning it is a static binding that will not be overwritten by ARP protocol updates. With ip, you can check for the permanent state:

ip neigh show

4. Remove a Static Binding

arp -d 192.168.1.1

The equivalent ip command is:

ip neigh del 192.168.1.1 dev eth0

Notes

  1. Make sure the IP-to-MAC mapping is correct before binding; a wrong binding will break communication for that IP;
  2. Static ARP entries are lost after a reboot, so write them into /etc/rc.local or configure the network interface for auto-binding at boot;
  3. This method mainly protects against ARP spoofing on the same LAN segment and is less effective against cross-segment attacks;
  4. For more thorough protection, combine it with switch port security, DHCP Snooping, and DAI (Dynamic ARP Inspection) to drop forged ARP frames at the switch layer.

FAQ

  • Still losing connectivity after binding the gateway? Check that you bound the right interface and the real MAC; cross-check with ip neigh. Another possibility is that the switch also enforces port binding, and the two policies conflict and drop packets;
  • Do I need to bind every host on the server? No. Protect the gateway and core services; too many entries become hard to maintain;
  • Does this apply to cloud servers? Usually not — clouds isolate tenants with virtual switches, but it is very practical for physical servers in self-managed server rooms;
  • The gateway changed its MAC? Delete the old entry with arp -d first, then bind the new address; otherwise communication keeps failing.

LAN security is an easily overlooked part of server operations. For more server security hardening content, see the security hardening category, such as server security hardening and server initial security setup.

Original post: https://www.cnblogs.com/cqzhuomi/articles/17283225.html (cnblogs.com CQZHUOMI, repost)
Reference: ip-neighbour man page — https://man7.org/linux/man-pages/man8/ip-neighbour.8.html