[Snort-users] does snort support token ring card
mkettler at ...4108...
Fri Nov 28 10:54:08 EST 2003
At 08:14 AM 11/28/2003, Martin Olsson wrote:
>I haven't tried it on Token-Ring either, but I guess that even if snort
>itself support token ring frames, many of the snort rules are built with
>fix offsets for ethernet-frames.
>If I'm not mistaken, token-ring-frames might have larger DLC or LLC
>headers, putting the IP-header on a different offset than in an ethernet
nearly all snort rules are built with ofsets that are relative to the IP or
transport-layer (tcp, udp, etc) headers..
AFAIK it's impossible to build one with an absolute offset from the start
of the link-layer headers.
More information about the Snort-users