Super Stealth - ARP filtering plug-in

[Dmut]

DO NOT RUN THIS PLUG-IN, IF YOU DO NOT CLEARLY UNDERSTAND HOW ETHERNET LAN AND ARP PROTOCOL WORKS!

Take a look at SuperStealth for Outpost v2 here: http://www.outpostfirewall.com/forum...&threadid=7532

THIS SOFTWARE BELONG TO ME AND OFFICIALLY UNSUPPORTED BY AGNITUM.

What is it and how it's works: plug-in filter-off ARP requests from all hosts which are not included in trusted list. When ARP request filtered, system can not send info about your IP's to requester host. From requester side it is looks like your machine is not presented in LAN.
This situation only applied for hosts in your Ethernet segment, other hosts resolving your IP via ARP requests to your nearest router.

With correct using this plug-in you will get "complete security" (*) in your Ethernet segment. It will shield you against any IP-based attack, scans, floods, connection requests, all IP-based (and higher: TCP, HTTP, FTP) incoming traffic from your LAN neighbors.

(*) for more info about "complete security", please read this thread.

How to install:
1) Shutdown Agnitum Outpost.
2) Run "super stealth.exe" and follow instructions.
3) Load Agnitum Outpost manually or restart operation system to load it automatically.
4) When "Super Stealth" has been installed successfully, you will see new plug-in in outpost's left panel.

IMPORTANT: install will overwrite all prevision "super stealth" plug-in files, including your own customized "trusted_mac.lst"

You should set up configuration for "super stealth" after installation to continue working with internet by entering MAC addresses of your router/gateway ( otherwise it could not be able to send to you IP packets), and other critical machines, like your DNS servers, DHCP servers, etc, of course if they are located in your Ethernet segment.
Before first setup you must disable "super stealth" - right click on plug-in name, un-check "enable".
To make easy setup, do following:
1) clear your ARP table running "arp -d"
2) run "tracert" to any external fast internet site, like yahoo, save the tracing result.
3) run "arp -a" and select MAC address from first IP in your trace route, save MAC, it is your nearest router's MAC
4) clear your ARP table again
5) ping to any external fast internet site
6) run "arp -a" and select additional MAC's ( sometimes route in and route out going through different servers ), save those MACs too.
Enter those saved MAC addresses to "Trusted MAC list" in "super stealth" plug-in configuration and enable plug-in.

Known issues and limitations:
1) With shutdown OP, plugin store it is local MAC and trusted MAC list configuration in "trusted_mac.lst", every time erasing and creating that file again, so any manual changes to that file, while plug-in running, will be discarded.
2) Plug-in doesn't collecting any logs, because logs are useless in this case.
Sources included, project files provided for VC6 and VC7.

Important: After installation check "super stealth" configuration to make sure your local MAC address detected successfully, otherwise you could not be able to surf.

Feedback and bug reports are strongly appreciated, please use Agnitum Plug-ins Developers forum http://www.agnitum.com/forum/forumdi...?s=&forumid=56

see latest post in that tread for newest info about "super stealth" plug-in.

You may look at pages, created by Stephen (RISC OS)(thank you friend ) here, very usefull guide about Outpost and plugins, including third-party plugins.

[Dmut]

Changes:
1) ss_int.dll linked as static .dll, prevision version didn't work without mfc70.dll
2) Algorythm of getting local MAC address rewritten, now working without NETBIOS protocol presence.

Feel free to ask me a questions about that plug-in.

Plug-in temporary unavailable for downloading, having problems with current version of SDK, waiting for version 1.1

[Dmut]

2002-07-11
+ fully automatic install/uninstall
+ two MAC address format supported: "xx-xx-xx-xx-xx-xx" and "xx:xx:xx:xx:xx:xx"
! small fixes

You may see "Super Stealth" plug-in screenshot here.

DL "super stealth" plug-in from here.

Read updated "readme.txt" file after installation.