Snort mailing list archives
A question on ethernet padding
From: James Lay <jlay () slave-tothe-box net>
Date: Thu, 23 Jan 2014 09:07:27 -0700
Does snort treat ethernet padding as data? Wireshark shows that I have 1 byte of data in a packet after my ethernet and ip headers. My ethernet header, normally 14 bytes, includes 17 bytes of Padding. Does snort consider the padding as data? Trying to figure out what offset and depth to use on this rule. Hope I'm explaining this well..thanks all. James ------------------------------------------------------------------------------ CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing CenturyLink Cloud For Critical Workloads, Development Environments & Everything In Between. Get a Quote or Start a Free Trial Today. http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- A question on ethernet padding James Lay (Jan 23)
- Re: A question on ethernet padding Jeremy Hoel (Jan 23)
- Re: A question on ethernet padding James Lay (Jan 23)
- Re: A question on ethernet padding Jeremy Hoel (Jan 23)
- Re: A question on ethernet padding Jeremy Hoel (Jan 23)
- Re: A question on ethernet padding James Lay (Jan 23)
- Re: A question on ethernet padding James Lay (Jan 23)
- Re: A question on ethernet padding Jeremy Hoel (Jan 23)