Mailinglist archives

[list-arpalert] Receiving alerts even if ip_change specified

From: Ing. Bøetislav Kubesa <webmaster_at_zippbrno.cz>
Date: Fri, 02 Oct 2009 08:46:58 +0200

Hello,

I have in my maclist.allow following entries like this one :
00:1b:fc:34:09:35 192.168.0.215 rl0 ip_change

...but I'm receiving notifications about "Intrusion detection"

Am I missing something ? Strange is that for others entries is working,
but today I just received warning for 3 IPs, maybe due to the DHCP lease
timeout....

Thank you.

BK

/!\ Intruder Detected /!

Intrusion time stamp : Fri, 2 Oct 2009 07:05:54 +0200

Intruder FQDN :
Intruder IP Address : 169.254.135.192
Intruder MAC Address : 00:1e:c1:57:87:c0
Type of alert : rl0

...after while (DHCP assign IP) :

/!\ Intruder Detected /!

Intrusion time stamp : Fri, 2 Oct 2009 07:10:18 +0200

Intruder FQDN : 3comswitch.priv.domain.com
Intruder IP Address : 192.168.0.199
Intruder MAC Address : 00:1e:c1:57:87:c0
Type of alert : rl0

-- 
To unsubscribe send a mail to list+unsubscribe_at_arpalert.org
Received on Fri Oct 02 2009 - 08:47:38 CEST