Snort mailing list archives
RE: Rogue system detection
From: "Bob Konigsberg" <bobkberg () networkeval com>
Date: Tue, 26 Apr 2005 09:41:55 -0700
Well, a starting point might be to use an SNMP utility to dump the arp cache on the local router.... I use getarp.exe from NetLatency.com's download page http://www.netlatency.com/products/utilities.asp It runs from a windows command line window, and so can be tied in to other scripts Bob _____ From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of John Hally Sent: Tuesday, April 26, 2005 9:32 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Rogue system detection Hello All, I have a question that's not necessarily a snort thing, but I have no idea what other list to ask, so here goes. What are people using out there for rogue system detection? I'm trying to figure out how to passively detect when a 'new' system comes online in the local network and possibly detect the os and such. I imagine the tool would have to be able to match MAC addresses to deal with changing addresses and DHCP, along with report/alert when something new comes online. Maybe RNA? Thanks in advance! John H.
Current thread:
- Rogue system detection John Hally (Apr 26)
- RE: Rogue system detection Bob Konigsberg (Apr 26)
- Re: Rogue system detection Harry Hoffman (Apr 26)
- Re: Rogue system detection Skip Carter (Apr 26)
- <Possible follow-ups>
- Re: Rogue system detection Skip Carter (Apr 27)