Re: Snort-users digest, Vol 1 #1731 - 12 msgs

[Peter Kahle <pkahle () pobox com>]

Snort has very basic support for ipv6, but it doesn't do more than
increment a counter, and ignores the guts of the packet. I was
considering trying to add better support for ipv6, before life got in
the way, but it seems like it would be non-trivial, but not all that
hard. You can borrow a lot of code from the ipv4 code. The problem comes
in with packets with multiple subheaders, and in the use of packet
header structure in the TCP and UDP parsing code. Oh, and ICMPv6 is
different from the ipv4 version. Haven't done my homework on that, so I
don't know how big the differences are.
Hope that helps, and if anyone starts working on this, let me know.
P
-- 

Those who would give up essential Liberty to purchase a little temporary 
safety, deserve neither Liberty nor safety.
                                        -- Ben Franklin

|| Peter M Kahle Jr              ||     PGP Public Key on Keyservers     ||
|| pkahle () pobox com              ||    http://pops.dyndns.com/~pkahle/   || 
##===============================##======================================##

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users