[Snort-users] [Newbie] pppoe
willish at ...953...
Thu Jun 7 09:14:15 EDT 2001
On Thu, 7 Jun 2001 07:41:59 -0500
Marc Thompson wrote:
> It looks like it is working, just doesn't know how to
> decode the protocol:
> OTHER: 2009 (99.851%)
> Are you using a DSL modem? It may be possible to exchange
> your DSL modem for one that has a bona-fide Ethernet connection
> in it.
I haven't look the snort source code yet, but it may be possible
to implement pppoe desencapsulation like does ethereal ...
Do you think that is a hard task ?
What about snort performance ?
More information about the Snort-users