[Snort-users] Alert on new IP in use?

Donofrio, Lewis donofrio at ...1052...
Thu Aug 4 05:08:11 EDT 2005


So would I...
______________________________________________________________________
Lewis Donofrio at ...1052...
Cell: (734) 323-8776 


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net <snort-users-admin at lists.sourceforge.net>
To: James Riden <j.riden at ...11179...>
CC: Rich Adamson <radamson at ...2127...>; Snort Users Postings <snort-users at lists.sourceforge.net>
Sent: Wed Aug 03 22:58:31 2005
Subject: Re: [Snort-users] Alert on new IP in use?

I would like to see your script.

On 02 Aug 2005 13:46:54 +1200, James Riden <j.riden at ...11179...> wrote:
> Rich Adamson <radamson at ...2127...> writes:
> 
> > Looking for a way to monitor a small banking network and generate
> > an alert when an unused IP address is observed. The current IP's are
> > not consecutive.
> >
> > Example: we have 26 static IP addresses assigned to workstations and
> > servers. If a 27th (or greater) address appears on the wire, generate
> > an alert. (Note: not very interested in watching MAC addresses as some
> > of the IP's are behind another layer-3 device.)
> >
> > Thoughts?
> 
> I use p0f hooked into a perl script which generates a list of the
> active hosts for the day. It also does a DNS lookup, and anything
> without valid rDNS gets mailed to me.
> 
> The code is actually pretty trivial, but I'm happy to share it if
> anyone cares.
> 
> cheers,
>  Jamie
> --
> James Riden / j.riden at ...11179... / Systems Security Engineer
> Information Technology Services, Massey University, NZ.
> GPG public key available at: http://www.massey.ac.nz/~jriden/
> 
> 
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050804/9c204cf7/attachment.html>


More information about the Snort-users mailing list