SNORT: MAC Address Alert

["James Williams" <jwilliams () mail wtamu edu>]

We have been having an issue over the past couple of days where a couple
of computers are gaining access to our network and picking arbitrary IP
addresses to send SPAM emails. We have the MAC addresses of the
suspected computers and know which locations they are coming from, but
they do not spend much time in any one location. What I would like to do
is setup a box with snort and configure a very specific rule set to have
snort text message my mobile phone when it sees these two MAC addresses
on our network and possibly from which switch/wap/vlan/etc. Is this
possible? If so can somebody give me a couple configuration examples?

Thank you,

James Williams


---------------------------------------------------------------------------
Captus Networks IPS 4000
Intrusion Prevention and Traffic Shaping Technology to: 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
 - Automatically Control P2P, IM and Spam Traffic
 - Precisely Define and Implement Network Security & Performance Policies
FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo 
http://www.securityfocus.com/sponsor/CaptusNetworks_focus-ids_000101
---------------------------------------------------------------------------