cmg at ...402...
Thu Jan 30 05:07:08 EST 2003
"Stewart, Nicholas (ITD)" <NAS at ...1794...> writes:
> If I have two devices physically located close to each other with 4 up links
> and multiple VLANs,
> can I put one sensor device between the two to monitor ports on each device?
> Does the sensor need to be in one of the VLANs, or can a sensor read across
If you mean tagged vlans...
Snort will decode 1 vlan deep. We don't currently handle VLANs on top
of VLANs. If someone has a packet capture of nested VLANs, I would
love a small copy for decoder verification
Chris Green <cmg at ...402...>
Warning: time of day goes back, taking countermeasures.
More information about the Snort-devel