[Snort-users] [Newbie] pppoe

William Pomian willish at ...953...
Thu Jun 7 03:19:31 EDT 2001


I'm currently trying to use snort 1.7 on a NetBSD-1.5 home server with a
(rp-)pppoe connection. My ethernet card for the modem is fxp0 with
as IP adress. I have also a second card to my "home_net" which is rtk0 with as IP adress.

1] When runing snort on rtk0 interface, all works well.

2] When runing snort on fxp0 interface, snort runs, but nothing is logged,
    it seems to not understand pppoe protocol : 

Snort received 2012 packets and dropped 0(0.000%) packets

Breakdown by protocol:                Action Stats:
    TCP: 0          (0.000%)          ALERTS: 0         
    UDP: 0          (0.000%)          LOGGED: 0         
   ICMP: 0          (0.000%)          PASSED: 0         
    ARP: 0          (0.000%)
   IPv6: 0          (0.000%)
    IPX: 0          (0.000%)
  OTHER: 2009       (99.851%)
DISCARD: 0          (0.000%)

3] When runing snort on ppp0 interface, I get the following message :

$ /usr/local/bin/snort -Afull -c /etc/snort/snort.conf -i ppp0

        --== Initializing Snort ==--

Initializing Network Interface ppp0

/usr/local/bin/snort cannot handle data link type 50

I feel a bit lost.... Is there someone to explain me what can I do ?

William Pomian

More information about the Snort-users mailing list