Re: detect on specific MAC address

[Matt Kettler <mkettler () evi-inc com>]

At 09:31 AM 10/21/2004, Jericho Lee wrote:
> HI List,
>
>            We all know that snort can be in NIDS mode to detect all the 
> packets in the network, but can snort just detect some specific 
> destination address??
>            I have a computer with 2 NIC, and I want snort to detect some 
> packets send to the second NIC only,
> So other packets without the MAC address in the header the same with the 
> 2nd NIC MAC address will not be captured by snort,
> Can snort do this?

I'm not 100% I understand your question, but I think I do.. You want snort 
to run on only one of two interfaces, and only monitor one MAC (the local mac)

Some suggestions:

        1) use -i to force snort to only listen on the second interface
        2) use -p to turn off promisc sniffing
        3) use snort command line that has a BPF filter with the "ether 
host" keyword to restrict snort to only seeing traffic to/from a particular 
mac. See man tcpdump for info on BPF filter formats (tcpdump and snort use 
the same command line BPF filter format)



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users