arp packets

[ktroberson]

How do I configure security onion to capture ARP packets?

[cm-ops]

Steno should be recording it, but you will need to use stenoread to see it.

[ktroberson]

stenoread does not pull arp packets, at least I havent firgured it out

[cm-ops]

Still looking at the exact filter that would just pull the ARP only. But this works for me, change the timeframe based on size of your PCAP sizing (mine is a test machine), so-pcap-export 'after 2023-05-16T00:00:00Z and before 2023-05-17T00:00:00Z' output then check the PCAP with either tcpdump -r /nsm/pcapout/output.pcap | grep -i arp | grep -v IP (add whatever other flags to tcpdump you want as well) or tshark -r /nsm/pcapout/output.pcap -Y arp.

What I get is the following:

[root@so-sensor ~]# tcpdump -r /nsm/pcapout/output.pcap | grep -i arp | grep -v IP
reading from file /nsm/pcapout/output.pcap, link-type EN10MB (Ethernet)
12:25:11.048038 ARP, Request who-has 192.168.1.102 tell 192.168.1.101, length 28
12:25:11.048066 ARP, Reply 192.168.1.102 is-at 00:17:a4:90:0b:fd (oui Unknown), length 46
12:25:11.049846 ARP, Request who-has 192.168.1.2 tell 192.168.1.101, length 28
12:25:11.049888 ARP, Request who-has 192.168.1.2 tell 192.168.1.101, length 28
12:25:11.049903 ARP, Request who-has 192.168.1.3 tell 192.168.1.101, length 28
12:25:11.049932 ARP, Request who-has 192.168.1.4 tell 192.168.1.101, length 28
12:25:11.050033 ARP, Request who-has 192.168.1.5 tell 192.168.1.101, length 28
12:25:11.050077 ARP, Request who-has 192.168.1.6 tell 192.168.1.101, length 28
12:25:11.050103 ARP, Request who-has 192.168.1.7 tell 192.168.1.101, length 28
12:25:11.050117 ARP, Request who-has 192.168.1.7 tell 192.168.1.101, length 28
12:25:11.050145 ARP, Request who-has 192.168.1.8 tell 192.168.1.101, length 28

And:

[root@so-sensor ~]# tshark -r /nsm/pcapout/output.pcap -Y arp
Running as user "root" and group "root". This could be dangerous.
5807        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.102?  Tell 192.168.1.101
5808        261 Hewlett-_90:0b:fd -> Giga-Byt_a4:78:24 ARP 60 192.168.1.102 is at 00:17:a4:90:0b:fd
5888        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.2?  Tell 192.168.1.101
5890        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.2?  Tell 192.168.1.101
5891        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.3?  Tell 192.168.1.101
5892        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.4?  Tell 192.168.1.101
5897        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.5?  Tell 192.168.1.101
5899        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.6?  Tell 192.168.1.101
5900        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.7?  Tell 192.168.1.101
5901        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.7?  Tell 192.168.1.101
5902        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.8?  Tell 192.168.1.101
5903        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.9?  Tell 192.168.1.101
5904        261 Giga-Byt_a4:78:24 -> Broadcast    ARP 42 Who has 192.168.1.9?  Tell 192.168.1.101