[Snort-users] snort & pppoe

Jo jo at ...9672...
Wed Dec 3 08:42:12 EST 2003


hi,

i use snort2.0.2, barnyard & acid on the following machine

extern----pppoe-eth0-ROUTER-eth1----intern

i run snort for tests on all 3 interfaces.

eth0 & ppp0 detect the same alerts.
-is eth0 decoding the pppoe packets?

eth0 & ppp0 doesnt work for payload logging.
-why can they detect payload signatures but log them?

i wrote some pass rules to ignore some traffic.
-is it possible config a var for the dynamic pppoe ip?

thx for help
jo




More information about the Snort-users mailing list