RE: 802.1q Monitoring

["Ron Shuck" <rshuck () Buchanan com>]

Hi Chris,

I have to make it work for a client, so I will work with you to make
sure I do it in a way that can be used in the general snort code. I am a
C programmer from a previous life, so I may be a little rusty. The
client fully supports open source and has given me permission to submit
any work done as long as it does not compromise the security of their
system.

BTW, can you give me any feedback on the problem I see with changing
rule order causing some alerts not to fire. I posted a while back. I
have had several people tell me they see similar results, but I haven't
seen anything in users or devel lists.

Thanks,

Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant 
Buchanan Associates - A Technology Company in the People Business 
http://www.buchanan.com 
http://www.isc2.org
http://www.giac.org


-----Original Message-----
From: Chris Green [mailto:cmg () sourcefire com] 
Sent: Friday, June 06, 2003 9:44 AM
To: Bennett Todd
Cc: Ron Shuck; snort-users () lists sourceforge net
Subject: Re: [Snort-users] 802.1q Monitoring


Bennett Todd <bet () rahul net> writes:

> 2003-06-05T16:46:00 Ron Shuck:
> > Has anyone implemented or tried to monitor a 802.1q (trunked) 
> > connection with Snort?

[...]

> If one snort config will work for all your vlans,

Extend DecodeVlan() to be able to decode what it finds in decode.c and
submit a patch to snort-devel and traffic captures of your trunked vlan
configuration.

Even if you don't have C skills, please send (atleast me) a packet
caputure of your trunked vlan.

Even if 1 snort config won't work for your vlans, you can use bpf to
filter by vlan id before it goes to snort and then run a separate snort
on each vlan.
-- 
Chris Green <cmg () sourcefire com>
 "Not everyone holds these truths to be self-evident, so we've worked
                  up a proof of them as Appendix A." --  Paul Prescod


-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users