I am learning about Snort and ran into a problem that i don't really understand.
My virtualized test lab consists of:
a pfSense VM with Snort (192.168.1.1),
an Ubuntu VM (192.168.1.100, 00:0c:29:da:97:a4),
a XP VM (192.168.1.200, 00:0c:29:e6:5e:42)
and a Kali Linux VM (192.168.1.101, 00:0c:29:83:83:7e).
I wanted to see if snort would detect ARP spoofing, here is what i did:
In my Kali VM, in Metasploit, i used auxiliary/spoof/arp/arp-poisoning with the following settings:
set DHOSTS 192.168.1.1 (pfSense)
set SHOSTS 192.168.1.200 (XP)
and started the exploit.
Then i sent a few pings from the XP VM to the pfSense.
In the Snort alerts, i see the ICMP packets coming from the XM VM and pfSense responding to them. Of course, the XP VM doesn't get any replies, and in Wireshark i can see that pfSense is trying to contact the XP VM, but uses the MAC Adress of Kali. Everything went as planned.
Then I tried the same thing, but in the Snort interface settings in IP preprocs, I activated the following:
But nothing changed, there are no alerts thrown by Snort and the spoofing is not prevented, the Ping replies from pfSense still don't reach the XP VM when i run the exploit.
What am I missing? Is there some rule I need to activate? Do i need to create my own rule? Are there any examples for this? I couldn't find anything helpful on the Internet, so I'm guessing that I'm making some newbie mistake somewhere.
I'll gladly appreciate your suggestions, and if necessary, i can provide more Information of my testing environment.