[Snort-devel] ATM, LANE, and Ethernet over Fiber?

Roelof JT Jonkman roel at ...60...
Fri Jan 4 17:34:02 EST 2002


This is particularly tough, on digital unix I got this to work, however the LANE
interface of these boxes represents itself as an ethernet interface 
essentially. (Besides that was in the days of snort 1.6.x)

With CLIP, unless you have a tweaked/custom version of libpcap that deals with
the particular interfaces you're more or less toast. Generally speaking
if you're doing ATM you're more or less toast at this point. ATM to the
host is pretty much history.

You may be able to make this possibly work under Linux, propably need to stick
to an older 2.2 kernel with Werner's ATM driver. I used to have a linux
box at my previous employer working with LANE/CLIP on linux. I can possibly
offer you some help with this. I'm not sure if libpcap works with a lane
interface however..... per usual ymmv. The only warning I have is that
a configuration like this is not particularly stable, largely due to the
complex nature of ATM.

Ethernet over fibre, should just be plain old ethernet: 100BaseFL or 10BaseFL,
you can even get converters that go from 100BaseT to 100BaseFL, cheaper than
buying a 100BaseFL card.

Roel Jonkman
Security Engineer

More information about the Snort-devel mailing list