Snort mailing list archives
Re: Rule works in replay file mode, but not when sniffing
From: waldo kitty <wkitty42 () windstream net>
Date: Fri, 12 Jul 2013 21:25:13 -0400
On 7/12/2013 18:29, Pavel Rantorski wrote:
Thank you, the problem was indeed the low snaplen size combined with VLAN use! After setting snaplen to 1542 (1518 didn't work even though the pcap packets were this large) and changing MTU on network interface accordingly, the rules work as expected.
i started to suggest a snaplength of 0 (zero) to get the entire packet but was confused by other data in your posts... -- NOTE: No off-list assistance is given without prior approval. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Rule works in replay file mode, but not when sniffing Pavel Rantorski (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Joel Esler (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Russ Combs (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Pavel Rantorski (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Russ Combs (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Pavel Rantorski (Jul 12)
- Message not available
- Re: Rule works in replay file mode, but not when sniffing Pavel Rantorski (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing waldo kitty (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Russ Combs (Jul 12)
- Re: Rule works in replay file mode, but not when sniffing Joel Esler (Jul 12)