Re: Snorting the MAC address

[Jason Yates <jyates () dataservice org>]

On Thu, 2002-04-11 at 18:01, Nate Haggard wrote:
> Snort grabs IPs, and that is great until someone tries to spoof their 
> IP.  Is there anyway to get snort to log both the IP and MAC address. 
>
> Does anyone know what part of the code to look at for this feature? 
>
> Maybe there is a good reason snort doesn't log the MAC and I'm just 
> clueless.

This would kinda be pointless, except for picking up MAC address's in
your LAN.   Since the MAC address on the packet is going to be the last 
router, not the source MAC of the packet.

-Jason




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users