Re: Detecting Broadcast with Snort

[Matt Kettler <mkettler () evi-inc com>]

Oh, I agree it would be a neat detection plugin.. and something that can 
likely be implemented by writing a plugin to the snort code.

 I was more going on just wondering what "corrective action" snort was 
expected to take :)

At 11:41 AM 2/21/2003 -0800, twig les wrote:
> This would be a neat plugin though - broadcast threshold alerts.
>  Once we netadmin types get a baseline it'd be nice to have
> warning when NIC driver goes nutso and starts broadcasting or
> somthing.



-------------------------------------------------------
This SF.net email is sponsored by: SlickEdit Inc. Develop an edge.
The most comprehensive and flexible code editor you can use.
Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial.
www.slickedit.com/sourceforge
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users