ARP Poisoning & Cisco IDS/IPS Solutions

erickweber · ‎06-03-2008

I am trying to find out if someone familiar with Cisco's IDS/IPS (network and/or host-based) solutions can tell me if the product(s) can identify and/or prevent ARP poison routing attacks. If so, does it require customizing signatures or is there out of the box detection signatures?

Thanks for any information

mhellman · ‎06-03-2008

There are some. Go here and do a search for "arp":

http://tools.cisco.com/security/center/search.x?search=Signature

Perhaps it goes without saying, but remember that the sensor has to see the relevant layer 2 traffic for these to work.

erickweber · ‎06-03-2008

Thanks!