Re: (spp_arpspoof) Ethernet/ARP Mismatch request for Destination

[Erek Adams <erek () snort org>]

On Fri, 7 Mar 2003, Jan Hugo Prins wrote:

> got this message in my alert file several times today, and I would have
> expected to have them in my tcpdump files as well. But the packets were not
> there. Is this normal or could there be some confuration error?

Nope, that's normal.  The arpspoof preprocessor doesn't log packets to any
facility, it just logs a message about it.  There's a patch that was just
sent over to snort-developers list that does add some detail to the
output, if you want more data.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users