RE: ARP-SPOOFING

From: shannong (shannong@texas.net)
Date: 09/10/02


From: "shannong" <shannong@texas.net>
To: <focus-ids@securityfocus.com>
Date: Tue, 10 Sep 2002 12:40:53 -0500

Some IDS do watch for this via "arp flip-flop". In otherwords, a MAC
was associated with one IP, then suddenly another IP. DHCP in a Win2k
environment is basically "static" as long as you have enough Ips. A
workstation will always pull the same IP address from DHCP based on MAC
unless it ran out of Ips and handed out to a new client who didn't
already have an IP previously.

-----Original Message-----
From: Falcifer [mailto:falcifer2001@yahoo.es]
Sent: Monday, September 09, 2002 10:37 AM
To: focus-ids@securityfocus.com
Subject: ARP-SPOOFING

hi
How can i detect an arp-spoofing in a environmet with a dynamic IP? Does
cablemodem operators usually install IDS? where?

Thanks _______________________________________________________________

Copa del Mundo de la FIFA 2002

El único lugar de Internet con vídeos de los 64 partidos.

¡Apúntante ya! en http://fifaworldcup.yahoo.com/fc/es/