Snort Alert Help

[Cmits]

Hey guys I am new to using snort and am curious on how to detect arp spoofing attacks. I see there is a preprocessor for arp so I enabled it but I have not received any alerts. How would I go about writing a rule for detecting arp spoofing?

Thanks

[bmeeks]

You don't need a specific rule, but you must input the MAC/IP pairs for all hosts you want to monitor in the table under the ARP Spoof Detection section of the PREPROCESSORS tab for the interface.  Be advised this option can be quite a log spammer and is not good at detecting many types of ARP attacks.  In short, it's a feature that sounds better than it really works in practice.  That's my humble opinion.  I added the configuration to the GUI because some users wanted to implement it.

Bill