[Snort-devel] vlan support

Frank Knobbe FKnobbe at ...339...
Mon Apr 9 17:42:55 EDT 2001


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Never mind... DecodeEthPkt gets the header separated from the packet.
I guess this check would have to occur right after the libnet call.
(Can't find that at the moment... need coffee... :)

Frank

> -----Original Message-----
> 
> Can't DecodeEthPkt just check the Ethernet header, and if it
> doesn't find 0x0800 in the right spot, let it memcpy the packet 4
> bytes to the left, and check for 0x0800 again? If there would be an
> indicator in the first 4 bytes that would specify it as a VLAN tag,
> that might even be cleaner...
> 
> Once the packet has been memcpy'd for bytes to the left,
> essentially the first four bytes clipped off, then all the other
> routines should be able to handle the packet, shouldn't they?
> 

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME encrypted email preferred.

iQA/AwUBOtIs35ytSsEygtEFEQIJWQCeOe3kcWMSwRZzc/SjFUwFnSxSpfgAniCC
5MdH2Ot1Z7463q5ku9dKp6HB
=W9TQ
-----END PGP SIGNATURE-----




More information about the Snort-devel mailing list