[Snort-users] does snort support token ring card

Matt Kettler mkettler at ...4108...
Fri Nov 28 10:54:08 EST 2003


At 08:14 AM 11/28/2003, Martin Olsson wrote:
>I haven't tried it on Token-Ring either, but I guess that even if snort
>itself support token ring frames, many of the snort rules are built with
>fix offsets for ethernet-frames.
>If I'm not mistaken, token-ring-frames might have larger DLC or LLC
>headers, putting the IP-header on a different offset than in an ethernet
>frame.

nearly all snort rules are built with ofsets that are relative to the IP or 
transport-layer (tcp, udp, etc) headers..

AFAIK it's impossible to build one with an absolute offset from the start 
of the link-layer headers.





More information about the Snort-users mailing list