Snort mailing list archives
Re: Rogue system detection
From: Harry Hoffman <hhoffman () ip-solutions net>
Date: Tue, 26 Apr 2005 13:25:15 -0400
arpwatch is quite good for this sort of thing John Hally wrote:
Hello All,I have a question that's not necessarily a snort thing, but I have no idea what other list to ask, so here goes. What are people using out there for rogue system detection? I'm trying to figure out how to passively detect when a 'new' system comes online in the local network and possibly detect the os and such. I imagine the tool would have to be able to match MAC addresses to deal with changing addresses and DHCP, along with report/alert when something new comes online. Maybe RNA?Thanks in advance!John H.
------------------------------------------------------- SF.Net email is sponsored by: Tell us your software development plans! Take this survey and enter to win a one-year sub to SourceForge.net Plus IDC's 2005 look-ahead and a copy of this survey Click here to start! http://www.idcswdc.com/cgi-bin/survey?id=105hix _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rogue system detection John Hally (Apr 26)
- RE: Rogue system detection Bob Konigsberg (Apr 26)
- Re: Rogue system detection Harry Hoffman (Apr 26)
- Re: Rogue system detection Skip Carter (Apr 26)
- <Possible follow-ups>
- Re: Rogue system detection Skip Carter (Apr 27)