TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Just thought i'd offer my 2cents worth here..
IP Duplicates are usually just that. If you have a PC/Router and you change
or swap IP addresses then the sensor is not smart enough to know what you
have done.
If you have fixed the problem then the only way I have found to stop the
events is to stop and start the sensor - this seems to clear the memory the
sensor has of the MAC address/IP address combination.
Regards
MARC CLASS
Melbourne Australia
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Jason Renard
Sent: Friday, 1 June 2001 3:24
To: Paul Leger
Cc: [EMAIL PROTECTED]
Subject: Re: Filter out ipduplicates
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Hi Paul,
Sorry I don't know how to do this - but is everything configured okay?
I'm not sure whether Realsecure bases this alert (a) purely on ARP
packets, or whether (b) it checks the MAC address in all IP packets.
I'd've thought (b) was an overhead so (a) seems more likely but I may
be wrong.
If (a) is this case then i don't know why your realsecure server is
seeing "duplicate ip addresses" in the first place. I must be missing
something here? Wouldn't it be looking for two different ARP replies,
over a period of time, for the same IP address? I can't see how you'd
get that with a normal dual-homed router unless you had some kind of
proxy arp setup, or had somehow misconfigured things. Hosts wanting to
send traffic THROUGH the router would ARP for the router's MAC itself.
Tch I do think I'm missing something here...
Jason
On Wed, 30 May 2001 09:46:59 -0300, you wrote:
>
>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
>---------------------------------------------------------------------------
-
>
>Hi,
>A dual homed router was just installed recently on my network and i've been
>flooded with ipduplicate messages. I would like to know how to
>filter out just the ipduplicates for this router. Is it possible?
>
>thanks,
>
>Paul
>
>
>
Jason.Renard at Mail.Com
Warning - all views expressed are my own.
I cannot guarantee the accuracy of everything
I've said - use it at your own risk.
