Snort mailing list archives
Re: Snorting the MAC address
From: Jason Yates <jyates () dataservice org>
Date: 11 Apr 2002 17:35:00 -0400
On Thu, 2002-04-11 at 18:01, Nate Haggard wrote:
Snort grabs IPs, and that is great until someone tries to spoof their IP. Is there anyway to get snort to log both the IP and MAC address. Does anyone know what part of the code to look at for this feature? Maybe there is a good reason snort doesn't log the MAC and I'm just clueless.
This would kinda be pointless, except for picking up MAC address's in your LAN. Since the MAC address on the packet is going to be the last router, not the source MAC of the packet. -Jason _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snorting the MAC address Nate Haggard (Apr 11)
- Re: Snorting the MAC address Erek Adams (Apr 11)
- Re: Snorting the MAC address Jason Yates (Apr 11)
- Re: Snorting the MAC address James Hoagland (Apr 11)
- <Possible follow-ups>
- RE: Snorting the MAC address Turner Ryan S CONT KPWA (Apr 11)
- RE: Snorting the MAC address Matt Kettler (Apr 11)
- Re: Snorting the MAC address SkatFiend (Apr 12)