[Snort-users] Snort log: Source MAC address record

Ayodele Okeowo aymacro at ...11827...
Mon Mar 11 16:26:27 EDT 2013

Thanks YM for your prompt response. I will check this out tonight and also
read more articles I can grab online to tune the results.


On Mon, Mar 11, 2013 at 3:59 PM, Y M <snort at ...15979...> wrote:

>  You may use the -e switch when running Snort. I haven't used it
> personally, but it may be worth a shot.
> "-e   Display the second layer header info"
> Also see this conversation titled "Snorting the MAC address", good
> information:
> http://seclists.org/snort/2002/q2/426
> YM
>  ------------------------------
> From: Ayodele Okeowo <aymacro at ...11827...>
> Sent: 3/11/2013 9:29 PM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Snort log: Source MAC address record
>  Hello,
> Can Snort also record the MAC address of a machine sourcing from my
> network? If not, is there any snort module that can help Snort?
> Ayo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130311/5e963e56/attachment.html>

More information about the Snort-users mailing list