|
|
|
|
Snort Forums Archive
Archive Home » Support » ARP detection
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
ARP detection
Posted by conacaraio on March 19, 2005 04:51:18
Hello,
I'm working on snort and mobile agent. I want to detect all arp request and response. I modify snort.conf like this :
#preprocessor arpspoof
preprocessor arpspoof_detect_host: 192.168.1.254 00:30:BD:1D:F8:D3
preprocessor arpspoof_detect_host: 192.168.1.253 00:80:AD:84:69:40
preprocessor arpspoof_detect_host: 192.168.1.200 00:70:AH:12:89:41
I make also a arp.rules that create an alert and i put it in the snort.conf. I use winarp_sk to attack my snort (linux) but it doesn't work. Can you help me ?
Thank you ! |
|
Posted by roesch on March 19, 2005 18:03:38
You should really be posting this on the snort-devel mailing list. Also check out the BUGS file so you can make a full report of what's going on as far as your version of Snort, platform, etc. Do you have any debug messages in your code to let you know it's being called? That's the first place to start...
-Marty
|
|
|
|
|
|
