<div dir="ltr"><br><div class="gmail_quote">On Wed, Mar 14, 2012 at 1:23 PM, ik <span dir="ltr"><<a href="mailto:idokan@gmail.com">idokan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello,<br>
<br>
I'm trying to detect a layer 7 based HTTP request, and see if it<br>
contain headers that provided as spoofed IP address.<br>
Is there a way to detect what is the Ethernet that the request arrived<br>
from at apace level ?<br>
<br>
If so, how can I provide rules what to do according to an HTTP header fields ?<br>
<br></blockquote><div> </div></div>You could look at the ARP cache by reading /proc/net/arp I guess.<br><br>You ARE aware that Ethernet MACs, just like IPs, can be 'spoofed', right?<br><br>If your LAN is insecure, secure your LAN. Don't run web applications on unsecure networks...<br>
<br>-- Shimi<br></div>