On Tue, 31 May 2005 16:32:43 +0200 (CEST) "Sylvain BERTRAND" <sylvain@xxxxxxxxxxxxxxxxxxxxxx> wrote: >apt-cache show arpwatch >[...] >Description: Ethernet/FDDI station activity monitor > Arpwatch maintains a database of Ethernet MAC addresses seen on the > network, with their associated IP pairs. Alerts the system administrator > via e-mail if any change happens, such as new station/activity, > flip-flops, changed and re-used old addresses. Yes exactly. If they fake both MAC and IP (in case you have DHCP changing MAC is enough because it will take the same IP), arpwatch doesn't find any changes. >Sylvain Peter _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
