bpf madness

["Todd Ransom" <transom () extremelogic com>]

I have 2 OpenBSD boxes, both with snort 1.8p1 installed.

On the OpenBSD 2.6 box, bpf filters work fine.  e.g. "snort -v port not 22"
shows me everything except ssh traffic

On the OpenBSD 2.7 box, bpf filters don't seem to work at all.  No matter
what I put in I seem to see all traffic.  Has anyone else seen this?  Do I
need a different version of libpcap?  If so, do I need to recompile snort
after updating libpcap?

TIA,
TR

=========================
"Information is not knowledge."
--Caleb Carr




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users