[Snort-users] mystery arp message

Chris Reining creining at ...6890...
Sun Oct 6 19:31:02 EDT 2002


There has been no significant changes in spp_arpspoof from 1.8.7 to 1.9.
It is *usable* but probably is not going to generate the data you are
looking for. I would recommend using arpwatch standalone.

-Chris
go badgers

On Thu, 03 Oct 2002 19:02:58 -0500
robin <mstubbs at ...842...> wrote:

> I got several messages from snort like this:
> [112:3:1] Ethernet destination/ARP target address mismatch [**]
> The problem being that I  would like to know something about the
> packet such as what address it
> came from. Is there a version of snort where this issue has been
> fixed? I think I'm using 1.87
> Otherwise can someone recommend another program that could detect the 
> same kind of issue?
> Thanks!





More information about the Snort-users mailing list