[Snort-devel] ARPSpoof.

From: Andrew Tan <andtan_sg(at)hotmail.com>
Date: Sun Feb 15 2004 - 22:46:15 EST

Hi,
Am also testing the -unicast option of ARP preprocessor arpspoof: -unicast
preprocessor arpspoof_detect_host: 10.1.1.1 00:D0:59:26:85:5E preprocessor arpspoof_detect_host: 10.1.1.2 00:D0:B7:44:9E:03

It is raising me Unicast ARP request alerts for the hosts that i have configured, fine. I also see False positives of Unicast ARP request alerts for the hosts that i have not confgiured in the list.

Please someone help me on this. Am i on the right track. Regards,
Tan.

---

Get 10mb of inbox space with MSN Hotmail Extra Storage http://join.msn.com/?pgmarket=en-sg

---

SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Sun Feb 15 22:55:23 2004