Commits

ddpbsd  committed 402c51c

new arpwatch rule

  • Participants
  • Parent commits b76e465

Comments (0)

Files changed (1)

File etc/rules/arpwatch_rules.xml

     <description>An IP has reverted to an old ethernet address.</description>
   </rule>
 
+  <rule id="7209" level="12">
+    <if_sid>7200</if_sid>
+    <match>ethernet mismatch</match>
+    <description>Probable aprspoofing attempt.</description>
+    <group>ip_spoof,</group>
+  </rule>
+
+
 
 </group> <!-- SYSLOG,arpwatch, -->