ARP signature series 7000 series
The 7000 series covers all ARP type traffic. Do not look for any of these in software versions prior to 4.0.
-
7101-ARP Source Broadcast: The sensor saw ARP packets with an ARP payload Source MAC broadcast address.
-
7102-ARP Reply-to-Broadcast: The sensor saw an ARP Reply packet with its payload Destination MAC containing a broadcast address.
-
7104-ARP MacAddress-Flip-Flop-Response: The sensor saw a set of ARP response packets where the ARP payload Mac-to-Ip mapping changed more than MacFlip number of times.
-
7105-ARP Inbalance-of-Requests: The sensor saw many more requests than it saw replies for an IP address out of the ARP payload.
Note The 7000 series signatures are only available in Cisco IDS versions 4.0 and newer.