[Snort-users] capturing arp

Spencer, Arthur Arthur.Spencer at ...8870...
Mon Apr 14 05:54:47 EDT 2003

In all of my tests you can't capture arp packets because they are
handled in hardware.  If you use Nemesis and generate an ARP packet it
isn't captured by Ethereal or Network General Sniffer.  

* Arthur J. Spencer (CISSP, CCNP, CCDP, MCSE, CNE)

-----Original Message-----
From: Patrick Amirian [mailto:pamirian at ...8855...] 
Sent: Friday, April 11, 2003 3:41 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] capturing arp

Hi guys,
I'm trying to caputre all arp packets doing

Alert arp any any <> any any

But I'm getting a segfault.
Ideas ?

Thank you. 

This SF.net email is sponsored by: Etnus, makers of TotalView, The
for complex code. Debugging C/C++ programs can leave you feeling lost
disoriented. TotalView can help you find your way. Available on major
and Linux platforms. Try it free. www.etnus.com
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list