Re: [Snort-users] Rogue system detection

arpwatch is quite good for this sort of thing

John Hally wrote:
> Hello All,
>
>  
>
> I have a question that's not necessarily a snort thing, but I have no 
> idea what other list to ask, so here goes.  What are people using out 
> there for rogue system detection?  I'm trying to figure out how to 
> passively detect when a 'new' system comes online in the local network 
> and possibly detect the os and such.  I imagine the tool would have to 
> be able to match MAC addresses to deal with changing addresses and DHCP, 
> along with report/alert when something new comes online.  Maybe RNA?
>
>  
>
> Thanks in advance!
>
>  
>
> John H.


-------------------------------------------------------
SF.Net email is sponsored by: Tell us your software development plans!
Take this survey and enter to win a one-year sub to SourceForge.net
Plus IDC's 2005 look-ahead and a copy of this survey
Click here to start!  http://www.idcswdc.com/cgi-bin/survey?id=105hix
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users