Alert Based on MAC Address

["Bamberger, Marc (M.A.)" <mbamberg () visteon com>]

I'm interested in tracking a PC that keeps changing it's IP address by it's
MAC (Ethernet) address. I would like to write a rule that would alert
whenever a certain MAC address appears in a packet.

It looks like the content keyword only scans the data of the packet and
doesn't match against headers. Am I misunderstanding the content keyword or
is there another way to accomplish this?

Any help would be appreciated.

Thanks,
Marc Bamberger

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users