[Snort-devel] Re: draft rfc - reengineering the snort packet matching system
fygrave at ...1...
Mon Apr 9 15:34:40 EDT 2001
On Mon, Apr 09, 2001 at 04:59:00AM -0400, Todd Lewis wrote:
> On Wed, 4 Apr 2001, Todd Lewis wrote:
> > (The Linux kernel file "include/linux/if_ether.h"
> > defines the IP protocol number ("ETH_P_IP") as 0x0800, but I for some
> > reason think that this doesn't actually mean 2048. Maybe endianness?
> Maybe stupidity. According to the IANA "ethernet-numbers" document,
> IP actually is ethernet protocol #2048. If I haven't mentioned it,
> I think that I would make a horrible SANA. 8^)
Actually it sounds correct to me. 2048 is '0x800' hex.. anything wrong with that? :)
More information about the Snort-devel