2 questions: Timeformat + ARP Despoofing.

[Glenn Larsson <ichinin () swipnet se>]

Hello.

2 Questions:
------------

1) Will future version of snort start using the
   locally set dateformat/timezone (using Win32)?

  I prefer to have events logged in

        YYYY/MM/DD-HH:MM:SS

  (Swedish) since that makes events automatically list in
  chronological order.

2) What do i look for when doing Arp despoofing?

        I know the usual;
        - Look for Mac adresses appearing > 1
        - Look for Massive arp traffic.
        - Compensate for DHCP traffic.
        (Et cetera)

I've read some docs on (arp-)Despoofing, but i've not
become any wizer.

Thanks.
Glenn

______________________________________________

Snort Log Despoofer, Version 0.0.2.b (Bin+Src)
http://www.geocities.com/ichinin/SLD.htm

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users