[Snort-users] preprocessor arpspoof

Matt Kettler mkettler at ...4108...
Tue Aug 17 17:40:41 EDT 2004


At 03:11 AM 8/17/2004, Juan Fernandez wrote:
>How I use arpwatch with snort ?
>
>I didn't see even the word arpwatch in snort.conf...
>
>Sorry im new to snort.

Arpwatch isn't a part of snort.. it's a completely separate tool, but it's 
a better tool for the job of monitoring arps than snort is.

Snort's a great IDS, but arp analysis isn't it's strong suit.. Arpwatch 
isn't an IDS at all, but it's very good at arp analysis.








More information about the Snort-users mailing list