RE: arpwatch

["David Gillett" <gillettdavid () fhda edu>]

  Suppose it's not monitoring the replies, but the *requests*.  These
are always broadcasts, and any machine attached out there should send
at least one before it sends any other traffic(*).

(*) - Except, of course, for DHCP requests, which can happen before 
it *has* an IP address, and therefore aren't useful for arpwatch's
stated purpose.

David Gillett


> -----Original Message-----
> From: zidan [mailto:zidan00 () fastmail fm]
> Sent: September 14, 2003 02:06
> To: Tony Kava
> Cc: security-basics () securityfocus com
> Subject: RE: arpwatch
>
>
> Tony,
>
> I tried requesting unknown IP addresses and arpwatch didn't detect it.
> arpwatch only detects the replies.
>
> the thing is, I have no monitoring port or special vlans, and 
> when I try
> sniffing network traffic in TCP/UDP
> level, I get nothing. so I assume there is no leak.
>
> I don't think arpwatch is using arp posinoning to detect those
> stations... I still can't figure out how it works.
>
>
> -Z
> -- 
>   zidan
>   zidan00 () fastmail fm
>
> -- 
> http://www.fastmail.fm - I mean, what is it about a decent 
> email service?
>
> --------------------------------------------------------------
> -------------
> Captus Networks 
> Are you prepared for the next Sobig & Blaster? 
>  - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
>  - Precisely Define and Implement Network Security 
>  - Automatically Control P2P, IM and Spam Traffic 
> FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
> http://www.captusnetworks.com/ads/42.htm
> --------------------------------------------------------------
> --------------

---------------------------------------------------------------------------
Captus Networks 
Are you prepared for the next Sobig & Blaster? 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
 - Precisely Define and Implement Network Security 
 - Automatically Control P2P, IM and Spam Traffic 
FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
http://www.captusnetworks.com/ads/42.htm
----------------------------------------------------------------------------