[Snort-devel] ARPSpoof.

Andrew Tan andtan_sg at ...445...
Sun Feb 15 19:50:04 EST 2004


Hi,
Am also testing the -unicast option of ARP
preprocessor arpspoof: -unicast
preprocessor arpspoof_detect_host: 10.1.1.1 00:D0:59:26:85:5E
preprocessor arpspoof_detect_host: 10.1.1.2 00:D0:B7:44:9E:03

It is raising me Unicast ARP request alerts for the hosts that i have 
configured, fine. I also see False positives of Unicast ARP request alerts 
for the hosts that i have not confgiured in the list.

Please someone help me on this. Am i on the right track.
Regards,
Tan.

_________________________________________________________________
Get 10mb of inbox space with MSN Hotmail Extra Storage 
http://join.msn.com/?pgmarket=en-sg





More information about the Snort-devel mailing list