Merge pull request #291 from raja-grewal/drop_gratuitous_arp

Drop gratuitous ARP packets

Author: adrelanos

README.md

@@ -110,8 +110,8 @@ Networking:
 - Respond to ARP requests only if the target IP address is  on-link,
   preventing some IP spoofing attacks.
 
-- Optional - Drop gratuitous ARP packets to prevent ARP cache poisoning
-  via man-in-the-middle and denial-of-service attacks.
+- Drop gratuitous ARP packets to prevent ARP cache poisoning via
+  man-in-the-middle and denial-of-service attacks.
 
 - Ignore ICMP echo requests to prevent clock fingerprinting and Smurf attacks.
 

usr/lib/sysctl.d/990-security-misc.conf

@@ -482,7 +482,7 @@ net.ipv4.conf.*.arp_ignore=2
 ## https://patchwork.ozlabs.org/project/netdev/patch/[email protected]/
 ## https://www.practicalnetworking.net/series/arp/gratuitous-arp/
 ##
-#net.ipv4.conf.*.drop_gratuitous_arp=1
+net.ipv4.conf.*.drop_gratuitous_arp=1
 
 ## Ignore ICMP echo requests.
 ## Prevents clock fingerprinting through ICMP timestamps and Smurf attacks.