Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ARP Poisoning & Cisco IDS/IPS Solutions

I am trying to find out if someone familiar with Cisco's IDS/IPS (network and/or host-based) solutions can tell me if the product(s) can identify and/or prevent ARP poison routing attacks. If so, does it require customizing signatures or is there out of the box detection signatures?

Thanks for any information

2 REPLIES
Gold

Re: ARP Poisoning & Cisco IDS/IPS Solutions

There are some. Go here and do a search for "arp":

http://tools.cisco.com/security/center/search.x?search=Signature

Perhaps it goes without saying, but remember that the sensor has to see the relevant layer 2 traffic for these to work.

Community Member

Re: ARP Poisoning & Cisco IDS/IPS Solutions

Thanks!

702
Views
5
Helpful
2
Replies
CreatePlease to create content