[Snort-devel] New Feature based on MAC address filterig (Possible !!!!!)

Atul Shrivastava atul_iet at ...398...
Mon Jun 16 21:24:02 EDT 2003

There is one feature which is lacking in Snort.
The feature is such that we can make rule based on the MAC address. I mean to say that I will make a pool of valid MAC addresses and then if any of the MAC addresses doesn't match with this MAC address pool then a alert has been generated for that. For that it is required to add one more preprocessor and then in that preprocessor we have to manually add the MAC addresses. Is it possible, because this feature is not there in any of the leading IDS.
This feature solves the problem that if anyone comes to your internal LAN physically with this laptop and then plugs his laptop into the internal LAN and takes a valid IP from some employess on personal basis and try to copy some important and confidential data from the network or try to do something illegal in the network, if this feature is there then he bill be caught by that thing.
Any sugessions are welcome.

Regards and have a nice day,

Atul Shrivastava


Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20030616/3a65ab64/attachment.html>

More information about the Snort-devel mailing list