ARP mangling:

[Terry Rankin <trankin () iqcenter com>]

Hello,


I've been using Snort v1.7 on NT4 successfully for a few weeks on several
networks with only one problem - all layer 3 info in ARP requests/replies
appears to be getting mangled between reception and logging. The symptoms
are as follows: 

1.  the target IP of the ARP request is always 212.250.18.0.
2.  the sending IP of the ARP request varies, but about 75% claim to be from
116.0.217.0. To date, the last two octets are always 217.0.
3.  no 'actual' ARP request layer 3 info is ever recorded to the log file -
just the butchered info.
4.  the ARP replies contain genuine layer 2 addresses. 

Example:    
  ARP who-has 212.250.18.0 tell 116.0.217.0.
  ARP who-has 212.250.18.0 tell 196.0.217.0
  ARP who-has 212.250.18.0 tell 124.3.217.0
  05/21-12:15:05.144373 ARP reply 212.250.18.0 is-at 0:10:5A:XX:YY:ZZ.

I've searched the obvious places for answers without any joy. I would be
extremely grateful for further information.


Cheers,


terry



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users