Snort mailing list archives
Re: decode_data_link option
From: Jason Brvenik <jasonb () sourcefire com>
Date: Mon, 05 Sep 2005 12:08:50 -0400
Pablo Nebrera wrote:
If I use this option it means that snort will check Layer2 headers and if not it will not.
It only means they will be decoded not checked.
What is the relation with the rules and preprocessors if I use it? Is recomendable use it as default??
no relationship. If you want to see the layer2 data use it otherwise leave it off.
ThanksPablo ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- decode_data_link option Pablo Nebrera (Sep 05)
- Re: decode_data_link option Jason Brvenik (Sep 05)