Snort mailing list archives
RE: Snort capturing ARP packets
From: "David" <dwad24 () excite com>
Date: Sat, 29 May 2004 01:12:31 -0400 (EDT)
Hey SGT b, You could use the arp command on a unix or linux box and pipe it through a few other commands and cut and paste the output into your snort.conf file.... This is a messy way of doing it:(assuming your arp -a output is the same as mine!) unixbox# arp -a | tail -5 | tr -s ' ' ' ' | cut -f2,4 -d' ' 192.168.1.1 00:01:03:63:83:2b192.168.1.2 00:04:25:df:cf:55192.168.1.3 00:06:23:dd:96:3f etc. hope that helps! Dave--- On Fri 05/28, sgt_b < sgt_b () security-forums com > wrote:From: sgt_b [mailto: sgt_b () security-forums com]To: snort-users@lists.sourceforge.netDate: Fri, 28 May 2004 13:47:55 -0500Subject: [Snort-users] Snort capturing ARP packetsHey everyone,Under what circumstances would Snort capture (or alert on) ARP packets? Is the arpspoof preprocessor the only thing that would trigger an alert based on an ARP packet?From snort.conf:"To make use of this preprocessor you must specify the IP and hardware address of hosts on the same layer 2 segment as you."Does this mean that in order for arpsoof to work, one has to statically map all IP-MAC pairs? Seems like a lot of work for little return. ;)Thanks!-------------------------------------------------------This SF.Net email is sponsored by: Oracle 10gGet certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE.http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click_______________________________________________Snort-users mailing listSnort-users@lists.sourceforge.netGo to this URL to change user options or unsubscribe:https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users list archive:http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!
Current thread:
- Snort capturing ARP packets sgt_b (May 28)
- <Possible follow-ups>
- RE: Snort capturing ARP packets David (May 28)