[Snort-devel] vlan support

Scott A. McIntyre scott at ...349...
Mon Apr 9 08:14:45 EDT 2001


Hi,

I've been trying to incorporate VLAN support into snort; I'm making slow
progress but have managed to get it to work fine on verbose output, that
is, if I tell decode.c that for frame type 802.1q it should add four
bytes to the packet size, but strip off those four for the capture, it
seems to return valid data.

However, this is won't work in a actual snort-as-ids mode, not will it
work with any filters applied (ie, no snort -vd port 25).  I'm going to
keep plugging at this as I really really want it to work, but I'm
wondering if someone else has already tackled it?  If so, drop me a
note, thanks.

Scott





More information about the Snort-devel mailing list