Re: does snort support token ring card

[Matt Kettler <mkettler () evi-inc com>]

At 08:14 AM 11/28/2003, Martin Olsson wrote:
> I haven't tried it on Token-Ring either, but I guess that even if snort
> itself support token ring frames, many of the snort rules are built with
> fix offsets for ethernet-frames.
> If I'm not mistaken, token-ring-frames might have larger DLC or LLC
> headers, putting the IP-header on a different offset than in an ethernet
> frame.

nearly all snort rules are built with ofsets that are relative to the IP or 
transport-layer (tcp, udp, etc) headers..

AFAIK it's impossible to build one with an absolute offset from the start 
of the link-layer headers.



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users