[Snort-users] [Newbie] pppoe

William Pomian willish at ...953...
Thu Jun 7 09:14:15 EDT 2001


On Thu, 7 Jun 2001 07:41:59 -0500 
Marc Thompson wrote:
> William,
> 
> It looks like it is working, just doesn't know how to
> decode the protocol:
> 
>   OTHER: 2009       (99.851%)
> 
> Are you using a DSL modem?  It may be possible to exchange
> your DSL modem for one that has a bona-fide Ethernet connection
> in it.

I haven't look the snort source code yet, but it may be possible
to implement pppoe desencapsulation like does ethereal ...

Do you think that is a hard task ?
What about snort performance ?

Thx Marc,

William.




More information about the Snort-users mailing list