alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg:"[ARP] arpalert - Detected ip change"; content: "type=ip_change"; classtype: suspicious-traffic; program: arpalert; normalize: arp; reference: url,wiki.quadrantsec.com/bin/view/Main/5000061; sid: 5000061; rev: 2;)
-- Main.Sagan-Wiki-Add - 2015-10-21
New revisions of 5000061 will be below...
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg:"[ARP] arpalert - Detected ip change"; content: "type=ip_change"; classtype: suspicious-traffic; program: arpalert; normalize; reference: url,wiki.quadrantsec.com/bin/view/Main/5000061; sid: 5000061; rev: 3;)
-- Main.Sagan-Wiki-Add - 2016-8-30