-
|
Hi, Pardon my ignorance, but why does https://docs.securityonion.net/en/2.4/arp.html use As per said issue summary: "...the expectation is that only Ethercat-related ARP traffic is logged." If the issue is ever fixed then SO ARP visibility will be broken. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
Hi @ephemeric , Wes Lambert created issue cisagov/icsnpp-ethercat#5 at my request back in 2022. Since then, there has not been any real progress towards changing this behavior. Because of that, we went ahead and documented the fact that ARP traffic is being logged because a few folks have asked about ARP logging. If and when that behavior is changed, we will update our documentation. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @dougburks, that is what I thought. |
Beta Was this translation helpful? Give feedback.
-
|
@dougburks FYI this has now been fixed in cisagov/icsnpp-ethercat#16 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
@ephemeric I've created issue #14783 to upgrade to the latest Ethercat plugin and update our documentation. |
Beta Was this translation helpful? Give feedback.
Hi @ephemeric ,
Wes Lambert created issue cisagov/icsnpp-ethercat#5 at my request back in 2022. Since then, there has not been any real progress towards changing this behavior. Because of that, we went ahead and documented the fact that ARP traffic is being logged because a few folks have asked about ARP logging. If and when that behavior is changed, we will update our documentation.