[Snort-users] Snort + IPv6

Matt Kettler mkettler at ...4108...
Tue May 27 15:15:19 EDT 2003


Well, it should be noted that the "ipv6 experiment" that Marty put out in 
December was NOT a IPv6 enabled version of snort.. it only had an IPv6 
decoder and printing engine.. no IPv6 support in the rules language, or 
detection engine, so it was strictly a very limited experiment to test a 
decoder only. It would however be able to detect anomalies in IPv4 tunnels 
running through IPv6.

You can re-read the post announcing it here:
http://lists.insecure.org/lists/focus-ids/2002/Dec/0069.html

If your needs are a full ipv6 aware version of snort, sorry, no such thing 
exists (yet), but you can take the presence of a decoder test as a sign 
that ipv6 support is on its way. If you need something that can analyze 
non-encrypted IPv4 tunnels in IPv6 packets, then perhaps someone on the 
list can direct you to a copy of the test code.


At 08:37 PM 5/27/2003 +0000, jhorgan at ...9307... wrote:
>Hi Folks
>
>I was wondering if anyone could tell me where i might get an ipv6 enabled
>version of snort, or if someone has one could they email it to me?
>
>i've tried the download www.snort.org/~roesch(etc)
>
>but that link no longer works.





More information about the Snort-users mailing list