[Snort-users] Alert on new IP in use?

Jason Benway benwaynet at ...11827...
Wed Aug 3 20:00:15 EDT 2005


I would like to see your script.

On 02 Aug 2005 13:46:54 +1200, James Riden <j.riden at ...11179...> wrote:
> Rich Adamson <radamson at ...2127...> writes:
> 
> > Looking for a way to monitor a small banking network and generate
> > an alert when an unused IP address is observed. The current IP's are
> > not consecutive.
> >
> > Example: we have 26 static IP addresses assigned to workstations and
> > servers. If a 27th (or greater) address appears on the wire, generate
> > an alert. (Note: not very interested in watching MAC addresses as some
> > of the IP's are behind another layer-3 device.)
> >
> > Thoughts?
> 
> I use p0f hooked into a perl script which generates a list of the
> active hosts for the day. It also does a DNS lookup, and anything
> without valid rDNS gets mailed to me.
> 
> The code is actually pretty trivial, but I'm happy to share it if
> anyone cares.
> 
> cheers,
>  Jamie
> --
> James Riden / j.riden at ...11179... / Systems Security Engineer
> Information Technology Services, Massey University, NZ.
> GPG public key available at: http://www.massey.ac.nz/~jriden/
> 
> 
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>




More information about the Snort-users mailing list