[Snort-users] Snort and encapsulation

Cynthia Leonard (cyleonar) cyleonar at ...589...
Tue Feb 7 08:39:07 EST 2017


Hi Ana,
It's not in the current plan for Snort 3.0.
I am not aware of any tool for this , I have not really looked for one.
It shouldn't be too hard to parse the packet , look for VXLAN header based on the VXLAN port and then pass the inner packet to Snort for detection.


Regards
Cynthia

From: Ana Serrano Mamolar [mailto:B00315494 at ...17757...]
Sent: Monday, February 6, 2017 11:27 PM
To: Cynthia Leonard (cyleonar) <cyleonar at ...589...>; snort-users at ...4626...ceforge.net
Subject: Re: Snort and encapsulation
Importance: High


Thanks Cynthia,

Do you know if it will be in short feature, like final version of Snort 3.0 ?

If not, do you know if there any other external module that I could use? I would need for my research.

Thanks.

________________________________
From: Cynthia Leonard (cyleonar) <cyleonar at ...589...<mailto:cyleonar at ...16686......>>
Sent: 06 February 2017 17:55:06
To: Ana Serrano Mamolar; snort-users at lists.sourceforge.net<mailto:snort-users at lists.sourceforge.net>
Subject: RE: Snort and encapsulation

Hi Ana,
Today Snort does not support VXLAN encapsulation.
In future, yes, there is plan  to support .

Regards
Cynthia


From: Ana Serrano Mamolar [mailto:B00315494 at ...17757...]
Sent: Monday, February 6, 2017 11:05 PM
To: snort-users at lists.sourceforge.net<mailto:snort-users at ...3783...net>
Subject: [Snort-users] Snort and encapsulation


Hi,

Does anybody knows if Snort support ( or plan to support) VXLAN encapsulation?



Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170207/975c4fd2/attachment.html>


More information about the Snort-users mailing list