Change of IP address

["Souza, Chris" <csouza () incharge org>]

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************

Hello,
 
How can I setup a rule in snort to detect when a machine had an ip address
changed. This Unixware box here on my network
mysteriously changes ip address's and I can't figure out how its doing that.
 
Can anyone help me?
 
Thanks
Chris