hi, i'd like snort analyzes packets from the network layer. i don't want it inspects packets from the physical layer or the link layer. Actually it's to sniff IP packets on ATM network. And when i run snort, the program exits. Is it possible to configure this? best regards, Teva AVRIL