Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

Add notes re: OUI and wireshark OUI lookup for arp_cache (#8272)

Browse Source 
* Add notes re: OUI and wireshark OUI lookup for arp_cache

* More info on ARP spoofing

Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>

* Fix links in markdown

Co-authored-by: Eric <eashaw@sailsjs.com>

Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
This commit is contained in:
Mo Zhu
2022-10-18 18:28:49 +00:00
committed by GitHub
co-authored by Guillaume Ross Eric
parent c576b9de20
commit 3b802232d0
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/fleet_schema.json
+2 -1
View File
@@ -30,7 +30,8 @@
},
{
"name": "arp_cache",
"examples": "List the content of the ARP cache.\n```\nSELECT address, interface, mac FROM arp_cache;\n```\nOn systems located in an office or datacenter, you can use this to watch for network attacks by checking for gateway IPs that do not have the expected MAC address.\n```\nSELECT * FROM arp_cache WHERE address IN (INSERT_GATEWAY_IPS) AND mac NOT IN (INSERT_EXPECTED_MAC_ADDRESSES);\n```\n"
"examples": "List the content of the ARP cache.\n```\nSELECT address, interface, mac FROM arp_cache;\n```\nOn systems located in an office or datacenter, you can use this to watch for network attacks by checking for gateway IPs that do not have the expected MAC address. This could indicate an [ARP spoofing](https://en.wikipedia.org/wiki/ARP_spoofing) attack, in which an attacker that controls a system on the LAN attempts to funnel all remote traffic through it so they can inspect it.\n```\nSELECT * FROM arp_cache WHERE address IN (INSERT_GATEWAY_IPS) AND mac NOT IN (INSERT_EXPECTED_MAC_ADDRESSES);\n```\n",
"notes": "* The first six digits of a MAC address is the [Organizationally Unique Identifier (OUI)](https://en.wikipedia.org/wiki/Organizationally_unique_identifier).\n* You can lookup the manufacturer and model via the MAC address using a tool like [wireshark OUI lookup](https://www.wireshark.org/tools/oui-lookup.html)."
},
{
"name": "asl",