[Snort-devel] vlan support
FKnobbe at ...339...
Mon Apr 9 17:42:55 EDT 2001
-----BEGIN PGP SIGNED MESSAGE-----
Never mind... DecodeEthPkt gets the header separated from the packet.
I guess this check would have to occur right after the libnet call.
(Can't find that at the moment... need coffee... :)
> -----Original Message-----
> Can't DecodeEthPkt just check the Ethernet header, and if it
> doesn't find 0x0800 in the right spot, let it memcpy the packet 4
> bytes to the left, and check for 0x0800 again? If there would be an
> indicator in the first 4 bytes that would specify it as a VLAN tag,
> that might even be cleaner...
> Once the packet has been memcpy'd for bytes to the left,
> essentially the first four bytes clipped off, then all the other
> routines should be able to handle the packet, shouldn't they?
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME encrypted email preferred.
-----END PGP SIGNATURE-----
More information about the Snort-devel