[Snort-devel] ARPSpoof.

From: Andrew Tan <andtan_sg(at)hotmail.com>
Date: Sun Feb 15 2004 - 22:01:03 EST

Hi,
I have one more question on the ARPspoof, alerts only the last host in the list,

Is it doing the following 2 things on the ARP packets : 1. If the destination address is found and is on the same port from which the frame was received, is the frame silently discarded, meaning is it filtered?.

2. If the destination address is found and is on a different port from which the frame was received, is the frame forwarded out through the port that corresponds to the destination's LAN segment, meaning selective forwarding.

Regards,
Tan

---

Keep track of Singapore & Malaysia stock prices. http://www.msn.com.sg/money/

---

SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Sun Feb 15 22:07:25 2004