[Snort-devel] Snort Sensors Die

Jeff Nathan jeff at ...835...
Thu Oct 3 15:32:03 EDT 2002


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Scott,

You've enabled the arpspoof preprocessor and uncommented the default host, 
but that's supposed to be an example.  That's a made up hardware address 
(F00F00F00F00).  If you're going to use spp_arpspoof, you should configure 
it for your network configuration, where you add IP addresses and their 
corresponding hardware addresses in snort.conf.


To fully diagnose your configuration, we'd have to see the actual error 
message.

- -Jeff


- --On Thursday, October 03, 2002 09:37:02 -0400 
"Scott_Avvento at ...1600..." <Scott_Avvento at ...1600...> wrote:

>  - preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00


- --
http://www.snort.org/~jeff       (pgp key available)
"Great spirits have always encountered violent opposition from mediocre
minds."
- - Albert Einstein
    
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9nMQpEqr8+Gkj0/0RAhmdAJ93jTugovts8ptX1lQby6F06FhjuACeP/zR
hevvNjVPUVbReUGc/8kxOlY=
=hzMv
-----END PGP SIGNATURE-----





More information about the Snort-devel mailing list