[Snort-devel] vlan support

Fyodor fygrave at ...1...
Mon Apr 9 08:26:24 EDT 2001


On Mon, Apr 09, 2001 at 02:14:45PM +0200, Scott A. McIntyre wrote:
> Hi,
> 
> I've been trying to incorporate VLAN support into snort; I'm making slow
> progress but have managed to get it to work fine on verbose output, that
> is, if I tell decode.c that for frame type 802.1q it should add four
> bytes to the packet size, but strip off those four for the capture, it
> seems to return valid data.

Urrr.. :) kinda messy.. do you have any tcpdump format files for testing, I may
help you 'reversing' the thing :). 






More information about the Snort-devel mailing list