Snort mailing list archives
Rogue system detection
From: John Hally <JHally () epnet com>
Date: Tue, 26 Apr 2005 12:31:54 -0400
Hello All, I have a question that's not necessarily a snort thing, but I have no idea what other list to ask, so here goes. What are people using out there for rogue system detection? I'm trying to figure out how to passively detect when a 'new' system comes online in the local network and possibly detect the os and such. I imagine the tool would have to be able to match MAC addresses to deal with changing addresses and DHCP, along with report/alert when something new comes online. Maybe RNA? Thanks in advance! John H.
Current thread:
- Rogue system detection John Hally (Apr 26)
- RE: Rogue system detection Bob Konigsberg (Apr 26)
- Re: Rogue system detection Harry Hoffman (Apr 26)
- Re: Rogue system detection Skip Carter (Apr 26)
- <Possible follow-ups>
- Re: Rogue system detection Skip Carter (Apr 27)