[Snort-devel] Snort 1.8.6 and PPPoE links

Chris Green cmg at ...402...
Mon Jun 24 07:04:02 EDT 2002


"C.J.O." <cjo at ...37...> writes:

> Re all,
>
> I'm running snort 1.8.6 in daemon mode and logging in binary format,
> and have been experiencing some "issues".
>
> This particular sensor is snorting via a NIC running stealth, which
> has been positioned directly behind a DSL modem with PPPoE
> connectivity.  Therefore the snort sensor is "seeing" raw PPPoE.

For us to do new link protocol decodes, please send tcpdump formatted
files from tcpdump -i interface -s 1514 -w pppoe.cap
-- 
Chris Green <cmg at ...402...>
A good pun is its own reword.




More information about the Snort-devel mailing list