RE: Alert Based on MAC Address

["Wirth, Jeff" <WirthJe () DNB com>]

> Am I misunderstanding the content keyword or is there another way to
accomplish this?

hmmm...I don't think snort in IDS mode can help you here.  The MAC lives in
the link-level header and the content keyword looks in the packet payload.
You may want to consider crafting something up with snort in sniffer mode
(or tcpdump) using the filter option.

i.e. # snort -v ether host <Enter your MAC here> 

This would trigger output anytime snort came across a packet with the MAC in
question.

Hope this helps..

- Jeff

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users