rp_filter

The rp_filter can reject incoming packets if their source address doesn’t match the network interface that they’re arriving on, which helps to prevent IP spoofing. Turning this on, however, has its consequences: If your host has several IP addresses on different interfaces, or if your single interface has multiple IP addresses on it, you’ll find that your kernel may end up rejecting valid traffic. It’s also important to note that even if you do not enable the rp_filter, protection against broadcast spoofing is always on. Also, the protection it provides is only against spoofed internal addresses; external addresses can still be spoofed.. By default, it is disabled. To enable it, run the following:

if [ -r /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo “Enabling rp_filter” echo “1″ > /proc/sys/net/ipv4/conf/all/rp_filter fi

原文

在 Linux 接收网络数据包时，如果一个包的源地址与其网卡地址不相符，则可通过 rp_filter 选项禁止接受这类包。通过这个来方式 ip 欺骗。
需要注意的是，如果你的机器有多个网卡，不同的网卡有不同的IP；或者单个网卡有不同的IP。你的内核可能会禁止正常的包。
另外，就算你没有打开 rp_filter 选项。“防止广播欺骗”的功能是一直被开启的。不过他只针对内网地址，外网地址并不会被过滤。