I am learning about Snort and ran into a problem that i don't really understand.

My virtualized test lab consists of:
a pfSense VM with Snort (,
an Ubuntu VM (, 00:0c:29:da:97:a4),
a XP VM (, 00:0c:29:e6:5e:42)
and a Kali Linux VM (, 00:0c:29:83:83:7e).

I wanted to see if snort would detect ARP spoofing, here is what i did:

In my Kali VM, in Metasploit, i used auxiliary/spoof/arp/arp-poisoning with the following settings:
set DHOSTS (pfSense)
and started the exploit.
Then i sent a few pings from the XP VM to the pfSense.
In the Snort alerts, i see the ICMP packets coming from the XM VM and pfSense responding to them. Of course, the XP VM doesn't get any replies, and in Wireshark i can see that pfSense is trying to contact the XP VM, but uses the MAC Adress of Kali. Everything went as planned.

Then I tried the same thing, but in the Snort interface settings in IP preprocs, I activated the following:

enter image description here

But nothing changed, there are no alerts thrown by Snort and the spoofing is not prevented, the Ping replies from pfSense still don't reach the XP VM when i run the exploit.
What am I missing? Is there some rule I need to activate? Do i need to create my own rule? Are there any examples for this? I couldn't find anything helpful on the Internet, so I'm guessing that I'm making some newbie mistake somewhere.

I'll gladly appreciate your suggestions, and if necessary, i can provide more Information of my testing environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.