TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Hi, I have the following in a small test environment (all v65): System [S2] with IP address [I2] MAC address [E2] - it's a Network Sensor System [S3] with IP address [I3] MAC address [E3] - it's an Event Collector System [S5] with IP address [I5] MAC address [E5] - it's a console Occasionally I see a Duplicate IP address event (there was one last night at 00:35), for example: Duplicate IP address (Suspicious arp) SourceIPaddress: I2 DestIPaddress: I3 SourceEthernetAddress: E2 SourceEthernetAddress: E3 MAC1: E5 MAC2: E2 The online help says "RealSecure Network Sensor detects the duplicate IP address by monitoring ARP packets and comparing the MAC address and IP addresses found in each packet. When it detects two packets with the same IP address address, but different MAC addresses it creates this IPDuplicate event" Please could somebody help with the following? 1) Does RealSecure only use ARP packets or will it examine normal IP packets as well? The latter would be more of an overhead, however it could catch more instances of duplicate IP addresses. 2) If RealSecure only uses ARP packets, does it use the DLC source/destination from those packets or does it use the payload Sender/Target fields? 3) Does RealSecure apply this processing to both SOURCE and DESTINATION addresses? 4) Most importantly, WHAT DO THOSE FIELDS MEAN? I presume the first four fields relate to the packet which tripped the event, and I'm assuming it was probably an ARP reply. So what do the fields MAC1 and MAC2 mean? 5) ANY other info on this topic would be appreciated so that I can try to put these events into context. Thanks, Jason Jason Renard Warning - all views expressed are my own. I cannot guarantee the accuracy of everything I've said - use it at your own risk.
