terça-feira, 17 de janeiro de 2012

Arpwatch

Observando um arpspoof em sua rede:

apt-get install arpwatch

arpwatch -i eth0

tail -f /var/log/syslog

Nov 10 22:29:48 rap arpwatch: changed ethernet address 172.16.0.102 00:a1:29:49:5b:92 (60:f4:59:27:9b:dc) eth0
Nov 10 22:29:48 rap arpwatch: changed ethernet address 172.16.0.102 00:a1:29:49:5b:92 (60:f4:59:27:9b:dc) eth0
Nov 10 22:29:48 rap arpwatch: reaper: pid 2827, exit status 1
Nov 10 22:29:48 rap arpwatch: reaper: pid 2828, exit status 1

Nenhum comentário: