Re: Watching MAC addresses instead of IP's

[Fyodor <fygrave () tigerteam net>]

On Sat, May 19, 2001 at 01:14:07AM -0500, Jev wrote:
> Hi all,
>
> I think this came up before, but giving a quick scan through the lists I
> didn't see anything.
>
> Is it possible to get snort to only watch traffic going to and coming
> from specific MAC address(es)?

try: 
snort ..... ether host 0:01:02:03:04:05
or
snort ..... ether src 0:01:02:03:04:05, depends on what
actually you want :)

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users