[Snort-users] BPF for ECN Bits

Joe McAlerney joey at ...47...
Thu May 24 15:19:21 EDT 2001


I wrote this one a while back.  It was tested, and seems to work. 
Please let me know if you find it is not doing the job.

# snort <command options> not 'tcp[13] & 192 != 0'

-Joe M.

-- 
|   Joe McAlerney     joey at ...155...   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

Erickson Brent W KPWA wrote:
> 
> Goodmorning,
> 
> Does anyone have a working example of a bpf filter for ignoring ECN bits ?
> I have searched the Snort forum and could not find anything although I
> remember the topic being discussed in the past.
> I am trying the have the Snort portscan pre-processor ignore SMTP connects
> with the ecn or reserved bits set. Or ignore all ecn or reserved bits.
> Thank you for your help,
> Brent Erickson
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list