RE: arpwatch

["zidan" <zidan00 () fastmail fm>]

Tony,

I tried requesting unknown IP addresses and arpwatch didn't detect it.
arpwatch only detects the replies.

the thing is, I have no monitoring port or special vlans, and when I try
sniffing network traffic in TCP/UDP
level, I get nothing. so I assume there is no leak.

I don't think arpwatch is using arp posinoning to detect those
stations... I still can't figure out how it works.


-Z
-- 
  zidan
  zidan00 () fastmail fm

-- 
http://www.fastmail.fm - I mean, what is it about a decent email service?

---------------------------------------------------------------------------
Captus Networks 
Are you prepared for the next Sobig & Blaster? 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
 - Precisely Define and Implement Network Security 
 - Automatically Control P2P, IM and Spam Traffic 
FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
http://www.captusnetworks.com/ads/42.htm
----------------------------------------------------------------------------