[Snort-users] Watching MAC addresses instead of IP's

Fyodor fygrave at ...121...
Sat May 19 16:20:49 EDT 2001


On Sat, May 19, 2001 at 01:14:07AM -0500, Jev wrote:
> Hi all,
> 
> I think this came up before, but giving a quick scan through the lists I
> didn't see anything.
> 
> Is it possible to get snort to only watch traffic going to and coming
> from specific MAC address(es)?
> 

try: 
snort ..... ether host 0:01:02:03:04:05
or
snort ..... ether src 0:01:02:03:04:05, depends on what
actually you want :)




More information about the Snort-users mailing list