Snort dies when arp spoof is detected



  • Hi,

    I have added an arp spoof preprocessor to snort (ie., preprocessor arpspoof) but when snort detects;
    (spp_arpspoof) Ethernet/ARP Mismatch request for Destination

    snort eventually dies. Looking at the logs I have;

    Nov 19 14:32:27 isfw kernel: pid 49346 (snort), uid 0: exited on signal 11
    Nov 19 14:32:27 isfw snort[61564]: (spp_arpspoof) Ethernet/ARP Mismatch request for Destination
    Nov 19 14:32:27 isfw snort[61564]: (spp_arpspoof) Ethernet/ARP Mismatch request for Destination
    Nov 19 14:32:27 isfw kernel: pid 61564 (snort), uid 0: exited on signal 11
    Nov 19 14:32:27 isfw kernel: em1: promiscuous mode disabled

    I am facing a black wall.  Thanks for your future insights on this matter.

    CrackBlue


Locked