Snort mailing list archives
Re: OT: VLANs and ngrep?
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Wed, 05 Sep 2007 05:34:07 +1200
Paul Melson wrote:
It appears to work for me on Fedora 7: # ngrep vlan 1 interface: eth0 (10.0.0.0/255.255.255.0) filter: (ip or ip6) and ( vlan 1 ) exit 0 received, 0 dropped
Try that with tcpdump and you'll see the problem (looks like ngrep doesn't have the same error checking tcpdump does). It plain cannot work if it starts with that "(ip)" or "(ip or ip6)" at the beginning. I have logged a bug in ngrep.sf.net so hopefully it will be fixed at some stage. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OT: VLANs and ngrep? Jason Haar (Sep 03)
- Re: OT: VLANs and ngrep? Paul Melson (Sep 04)
- Re: OT: VLANs and ngrep? Jason Haar (Sep 04)
- Re: OT: VLANs and ngrep? Paul Melson (Sep 04)