[Snort-devel] Man in the middle attacks

Jeff Nathan jeff at ...835...
Mon Nov 19 13:57:04 EST 2001


"Dominick, David" wrote:
> 
> the static AP is not an option, but the arpspoof is. Thank you. Do you have
> any information on the arpspoof preprocessor?
> 

In snort.conf just uncomment the arpsoof line and provided you're
running the latest from CVS add IP/MAC pairs one line at a time in the
following format:

arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00

if you're not running the latest from cvs, replace arpspoof_detect_host
with arpwatch

-Jeff

-- 
http://jeff.wwti.com            (pgp key available)
"Common sense is the collection of prejudices acquired by age eighteen."
- Albert Einstein




More information about the Snort-devel mailing list