Add feature to block invalid arps ? about xdp-firewall HOT 2 OPEN

Hey! I'm glad the project has helped you gain more knowledge in the networking/security fields!

I've seen XDP used for processing ARP requests, mostly for caching ARP entries inside of BPF maps. However, I haven't implemented ARP filtering/caching in any code I've written for XDP in the past. It is certainly possible, though!

Implementing ARP filtering/caching would be faster in XDP since it's the first hook for processing packets in the Linux kernel (assuming your NIC driver supports XDP native). However, I'm not sure if there will be any noticeable difference unless if you're under attack by attackers targeting ARP specifically.

It would be interesting to implement ARP filtering into this firewall, but I'm not sure if I'll have the time to implement such a feature in the near future due to time constraints and working on other projects. With that said, it'll require reworking a lot of the XDP logic.

I hope this helps!

from xdp-firewall.

Thanks for the patient reply

I first thought of this because I suddenly felt that maybe it would be better to defend DDoS at the arp level. After all, arp is the second layer.

Looking forward to future exploration and attempts,

Thanks again

from xdp-firewall.