[Snort-users] How does snort handle 802.1Q VLAN tag packets?

Matt Kettler mkettler at ...4108...
Wed Feb 9 14:30:22 EST 2005

At 05:15 PM 2/9/2005, Nyuk Loong Kiw wrote:

>Sorry for a newbie Q.
>Just finish reading a snort book and have got a play box up and running
>at home. Would like to know how does snort handle packets' that are VLAN
>tag? Will snort still be able to decode them properly??

Yes. Snort handles 802.1Q by recognizing that it's present and skipping 
past it's header prior to parsing the packet.

However, this does mean snort doesn't have any special 802.1Q rule options, 
but it's not adversely affected by their presence. 

More information about the Snort-users mailing list