Security Incidents mailing list archives

Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File

From: don () MAINFRAME DGRC CRC CA (Donald McLachlan)
Date: Fri, 21 Jan 2000 08:33:28 -0500


I don't know about the cause, but I would suggest getting, compiling, and
running arpwatch.  It watches all ARP packets and reports and logs any
changes of IP addr vs. MAC addr.

Of course this will not work if no ARP packets are sent.  :-(

Don

Current thread:

Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File Donald McLachlan (Jan 21)