[Snort-users] OT: VLANs and ngrep?

Jason Haar Jason.Haar at ...294...
Tue Sep 4 13:34:07 EDT 2007


Paul Melson wrote:
> It appears to work for me on Fedora 7:
>
> # ngrep vlan 1
> interface: eth0 (10.0.0.0/255.255.255.0)
> filter: (ip or ip6) and ( vlan 1 )
> exit
> 0 received, 0 dropped
>
>   
Try that with tcpdump and you'll see the problem (looks like ngrep
doesn't have the same error checking tcpdump does). It plain cannot work
if it starts with that "(ip)" or "(ip or ip6)" at the beginning.

I have logged a bug in ngrep.sf.net so hopefully it will be fixed at
some stage.

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1





More information about the Snort-users mailing list