[Snort-users] Alert on new IP in use?
benwaynet at ...11827...
Wed Aug 3 20:00:15 EDT 2005
I would like to see your script.
On 02 Aug 2005 13:46:54 +1200, James Riden <j.riden at ...11179...> wrote:
> Rich Adamson <radamson at ...2127...> writes:
> > Looking for a way to monitor a small banking network and generate
> > an alert when an unused IP address is observed. The current IP's are
> > not consecutive.
> > Example: we have 26 static IP addresses assigned to workstations and
> > servers. If a 27th (or greater) address appears on the wire, generate
> > an alert. (Note: not very interested in watching MAC addresses as some
> > of the IP's are behind another layer-3 device.)
> > Thoughts?
> I use p0f hooked into a perl script which generates a list of the
> active hosts for the day. It also does a DNS lookup, and anything
> without valid rDNS gets mailed to me.
> The code is actually pretty trivial, but I'm happy to share it if
> anyone cares.
> James Riden / j.riden at ...11179... / Systems Security Engineer
> Information Technology Services, Massey University, NZ.
> GPG public key available at: http://www.massey.ac.nz/~jriden/
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users