Re: How to handle BPDU packet in Snort?

[twig les <twigles () yahoo com>]

BPDUs are basic keepalives for STP (Spanning Tree Protocol, not
Stone Temple Pilots).  Since they work at L2 there is no way for
Snort to not see them short of turning STP off, which you can do
if you have a very simple infrastructure and are CERTAIN that no
switching loops will occur.  I see no reason to worry about
Snort or TCPDump seeing these.

--- Chris Green <cmg () sourcefire com> wrote:
> Please fill us in on what BPDU is and what you want to be able
> to do
> with it.
> -- 
> Chris Green <cmg () sourcefire com>
>  "Not everyone holds these truths to be self-evident, so we've
> worked
>                   up a proof of them as Appendix A." --  Paul
> Prescod
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
-----------------------------------------------------------
Know yourself and know your enemy and you will never fear defeat.         
-----------------------------------------------------------

__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users