[Snort-users] Snort and GTP encapsulation info

Ana Serrano Mamolar B00315494 at ...17757...
Tue Feb 14 11:37:50 EST 2017


In this case, with GRE+GTP it seems that is not working at all.

When gtp is enabled in the config, it can not filter by inner IP (GTP IP) as it happens when it just a GTP pcap.

Then, when gtp is disabled in the config, it can not filter by gtp_info or gtp_version as it happens when it just GTP pcap.

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170214/35497b1b/attachment.html>


More information about the Snort-users mailing list