[Snort-devel] Man in the middle attacks

Jeff Nathan jeff at ...835...
Mon Nov 19 13:57:04 EST 2001

"Dominick, David" wrote:
> the static AP is not an option, but the arpspoof is. Thank you. Do you have
> any information on the arpspoof preprocessor?

In snort.conf just uncomment the arpsoof line and provided you're
running the latest from CVS add IP/MAC pairs one line at a time in the
following format:

arpspoof_detect_host: f0:0f:00:f0:0f:00

if you're not running the latest from cvs, replace arpspoof_detect_host
with arpwatch


http://jeff.wwti.com            (pgp key available)
"Common sense is the collection of prejudices acquired by age eighteen."
- Albert Einstein

More information about the Snort-devel mailing list