Snort mailing list archives
Re: Watching MAC addresses instead of IP's
From: Fyodor <fygrave () tigerteam net>
Date: Sun, 20 May 2001 03:20:49 +0700
On Sat, May 19, 2001 at 01:14:07AM -0500, Jev wrote:
Hi all, I think this came up before, but giving a quick scan through the lists I didn't see anything. Is it possible to get snort to only watch traffic going to and coming from specific MAC address(es)?
try: snort ..... ether host 0:01:02:03:04:05 or snort ..... ether src 0:01:02:03:04:05, depends on what actually you want :) _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Watching MAC addresses instead of IP's Jev (May 19)
- Re: Watching MAC addresses instead of IP's Fyodor (May 19)
- <Possible follow-ups>
- Re: Watching MAC addresses instead of IP's roman (May 19)