[Snort-devel] ARPSpoof.

Andrew Tan andtan_sg at ...445...
Sun Feb 15 19:05:00 EST 2004


Hi,
I have one more question on the ARPspoof, alerts only the last host in the 
list,

Is it doing the following 2 things on the ARP packets :
1. If the destination address is found and is on the same port from which 
the frame was received, is the frame silently discarded, meaning is it 
filtered?.

2. If the destination address is found and is on a different port from which 
the frame was received, is the frame forwarded out through the port that 
corresponds to the destination's LAN segment, meaning selective forwarding.

Regards,
Tan

_________________________________________________________________
Keep track of Singapore & Malaysia stock prices. 
http://www.msn.com.sg/money/





More information about the Snort-devel mailing list