[Snort-devel] Snort IPv6 – We Need Your Input

Adam Keeton akeeton at ...402...
Thu Feb 1 12:32:15 EST 2007


We're in the process of upgrading Snort to handle IPv6 and want the
Snort community's feedback. Here we have another opportunity for you to
give your input on a Snort feature, and let us all benefit from your

We are looking for input on:

1) Is anyone using community written IPv6 modifications to Snort?
2) How many people are using IPV6 in their networks?
3) How are you using it?
  a) deep in the switching core?
  b) throughout the network?
  c) mixed ipv4 and ipv6, pure ipv6?
  d) do you tunnel ipv4 in ipv6 packets, or the reverse?
  e) Lab use only?
4) Are you using icmpv6, mixed icmpv6 and icmp?
5) ARP replacements for ipv6? Are you using using neighborhood discovery?
6) Any special issues setting up IPv6 and doing IDS or IPS on it?
7) How much use of the IPv6 extensions headers do you see or use:
  a) Hop-by-Hop Options?
  b) Routing Header?
  c) Authentication?
  d) Encryption?
8) How much fragmentation do you normally see?
9) How are you using or seeing IPv4 embedded addresses?
  a) Compatible (a zero'ed IPv6 address with an IPv4 address in the last
4 bytes)?
  b) Mapped?
  c) ISATAP?
  d) Teredo?
10) Do you use or see any anycast or multicast in IPv6?

In order to make Snort better, we need your help, and really want yourinput.

Don't be shy, the more we know the better we can make Snort!


We are also looking for some beta testers to work with the IPv6 enabled
Snort. If you have an IPv6 network and would like to participate please
respond back to snort-beta at ...402... We'll be sure to get you early
releases, and keep you updated as we get all of Snorts features updated.

Adam Keeton      Software Engineer
Snort Team       Sourcefire,Inc   
www.snort.org    www.sourcefire.com

More information about the Snort-devel mailing list