[Snort-users] Watching MAC addresses instead of IP's
fygrave at ...121...
Sat May 19 16:20:49 EDT 2001
On Sat, May 19, 2001 at 01:14:07AM -0500, Jev wrote:
> Hi all,
> I think this came up before, but giving a quick scan through the lists I
> didn't see anything.
> Is it possible to get snort to only watch traffic going to and coming
> from specific MAC address(es)?
snort ..... ether host 0:01:02:03:04:05
snort ..... ether src 0:01:02:03:04:05, depends on what
actually you want :)
More information about the Snort-users