[Snort-users] Snort and Nortel Accelar 1200
fportnoy at ...1527...
Sun Mar 11 08:17:32 EST 2001
> It's more than just the frame size ... it's that extra field in the header that carries the frame tagging information ... the IP and subsequent headers are no longer at the offsets they're expected to be at.
> The older
> Sniffers didn't know what to do with that information, and I'm wondering whether the other products know about it either?
Also, if you're running ARU 3's on your Accellar you'll see the traffic in both directions via your mirror port, but not if you're running ARU 2's. But you knew that.
More information about the Snort-users