[Snort-users] OT: VLANs and ngrep?
Jason.Haar at ...294...
Tue Sep 4 13:34:07 EDT 2007
Paul Melson wrote:
> It appears to work for me on Fedora 7:
> # ngrep vlan 1
> interface: eth0 (10.0.0.0/255.255.255.0)
> filter: (ip or ip6) and ( vlan 1 )
> 0 received, 0 dropped
Try that with tcpdump and you'll see the problem (looks like ngrep
doesn't have the same error checking tcpdump does). It plain cannot work
if it starts with that "(ip)" or "(ip or ip6)" at the beginning.
I have logged a bug in ngrep.sf.net so hopefully it will be fixed at
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
More information about the Snort-users