[Snort-users] a few questions...

waldo kitty wkitty42 at ...14940...
Tue Jul 9 11:41:34 EDT 2013


On 7/8/2013 10:10, Russ Combs wrote:
> On Fri, Jul 5, 2013 at 7:53 PM, waldo kitty <wkitty42 at ...14940...> wrote:
>
>     can you provide a hint on what is considered as "Other" packets that my short
>     run turned up? 125 of them makes me curious as to what is going on on that box
>     that i'm not aware of ;)
>
> They are cases where the decoding stopped due to an unsupported protocol, eg an
> ethertype for which there is no decoder.  It could also be that available
> decoders weren't built (./configure --enable-non-ether-decoders may help here).

done... along with --enable-sourcefire... will be testing shortly... i think 
that box has IPv6 capability but nothing actively uses it that we know of...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.




More information about the Snort-users mailing list