[Snort-devel] Re: draft rfc - reengineering the snort packet matching system

Todd Lewis tlewis at ...255...
Mon Apr 9 04:59:00 EDT 2001


On Wed, 4 Apr 2001, Todd Lewis wrote:

> (The Linux kernel file "include/linux/if_ether.h"
> defines the IP protocol number ("ETH_P_IP") as 0x0800, but I for some
> reason think that this doesn't actually mean 2048.  Maybe endianness?

Maybe stupidity.  According to the IANA "ethernet-numbers" document,
IP actually is ethernet protocol #2048.  If I haven't mentioned it,
I think that I would make a horrible SANA.  8^)

--
Todd Lewis
tlewis at ...255...





More information about the Snort-devel mailing list