IDS mailing list archives
Re: EXPERIMENTAL IPv6 decoder available in Snort
From: Frank Knobbe <fknobbe () knobbeits com>
Date: 27 Dec 2002 13:30:29 -0600
On Fri, 2002-12-27 at 07:38, Martin Roesch wrote:
Nope, Lance's issue (the honeynet project's, actually) was IPv6 tunneled over IPv4. I used packet captures from the compromised honeypot as my test data, so I'm pretty sure about that one. I don't think there's an option to tunnel v4 over v6, at least not that I was able to find in in.h.
On Tuesday, December 24, 2002, at 03:10 AM, Greg van der Gaast wrote:Don't you mean IPv4 tunneled over IPv6? (as in IPv4 traffic being sent inside an IPv6 tunnel) I thought that was Lance's issue. I might be mistaken here. In any case, thanks Marty. We love you ;)
From the man pages of FreeBSD: GIF(4) FreeBSD Kernel Interfaces Manual NAME gif - generic tunnel interface SYNOPSIS pseudo-device gif DESCRIPTION The gif interface is a generic tunnelling pseudo device for IPv4 and IPv6. It can tunnel IPv[46] traffic over IPv[46]. Therefore, there can be four possible configurations. The behavior of gif is mainly based on RFC2893 IPv6-over-IPv4 configured tunnel. On NetBSD, gif can also tunnel ISO traffic over IPv[46] using EON encapsulation. [...] I hope everyone had a great Christmas! Regards, Frank
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- EXPERIMENTAL IPv6 decoder available in Snort Martin Roesch (Dec 23)
- RE: EXPERIMENTAL IPv6 decoder available in Snort Greg van der Gaast (Dec 24)
- Re: EXPERIMENTAL IPv6 decoder available in Snort Martin Roesch (Dec 27)
- Re: EXPERIMENTAL IPv6 decoder available in Snort Frank Knobbe (Dec 27)
- Re: EXPERIMENTAL IPv6 decoder available in Snort Martin Roesch (Dec 27)
- <Possible follow-ups>
- Re: EXPERIMENTAL IPv6 decoder available in Snort mb_lima (Dec 27)
- Re: EXPERIMENTAL IPv6 decoder available in Snort mb_lima (Dec 27)
- RE: EXPERIMENTAL IPv6 decoder available in Snort Greg van der Gaast (Dec 24)