[Snort-users] BPF for ECN Bits
joey at ...47...
Thu May 24 15:19:21 EDT 2001
I wrote this one a while back. It was tested, and seems to work.
Please let me know if you find it is not doing the job.
# snort <command options> not 'tcp & 192 != 0'
| Joe McAlerney joey at ...155... |
| Silicon Defense - Technical Support for Snort |
| http://www.silicondefense.com/ |
Erickson Brent W KPWA wrote:
> Does anyone have a working example of a bpf filter for ignoring ECN bits ?
> I have searched the Snort forum and could not find anything although I
> remember the topic being discussed in the past.
> I am trying the have the Snort portscan pre-processor ignore SMTP connects
> with the ecn or reserved bits set. Or ignore all ecn or reserved bits.
> Thank you for your help,
> Brent Erickson
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users