[Snort-users] Bothersome portscans and some conjecture

Todd Ransom TRansom at ...197...
Mon Nov 20 14:58:07 EST 2000


On OpenBSD you bring up an interface with no ip address that will not ARP
like this:

ifconfig ep0 0.0.0.0 netmask 255.255.255.255 -arp

Don't know about other platforms.  But I can't figure out why an interface
with no ip would be ARPing in the first place.  I haven't actually verified
this, but if ARP is used to resolve an ip address to a MAC address before
sending an IP datagram, why would a system with no ip be ARPing?  I would be
interested to hear about scenarios where it would.

TR




More information about the Snort-users mailing list