Snort dies when arp spoof is detected
-
Hi,
I have added an arp spoof preprocessor to snort (ie., preprocessor arpspoof) but when snort detects;
(spp_arpspoof) Ethernet/ARP Mismatch request for Destinationsnort eventually dies. Looking at the logs I have;
Nov 19 14:32:27 isfw kernel: pid 49346 (snort), uid 0: exited on signal 11
Nov 19 14:32:27 isfw snort[61564]: (spp_arpspoof) Ethernet/ARP Mismatch request for Destination
Nov 19 14:32:27 isfw snort[61564]: (spp_arpspoof) Ethernet/ARP Mismatch request for Destination
Nov 19 14:32:27 isfw kernel: pid 61564 (snort), uid 0: exited on signal 11
Nov 19 14:32:27 isfw kernel: em1: promiscuous mode disabledI am facing a black wall. Thanks for your future insights on this matter.
CrackBlue