Re: How does snort handle 802.1Q VLAN tag packets?

[Matt Kettler <mkettler () evi-inc com>]

At 05:15 PM 2/9/2005, Nyuk Loong Kiw wrote:

> Sorry for a newbie Q.
>
> Just finish reading a snort book and have got a play box up and running
> at home. Would like to know how does snort handle packets' that are VLAN
> tag? Will snort still be able to decode them properly??

Yes. Snort handles 802.1Q by recognizing that it's present and skipping 
past it's header prior to parsing the packet.

However, this does mean snort doesn't have any special 802.1Q rule options, 
but it's not adversely affected by their presence. 



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users