Re: Using BPF Filters for GRE, OSPF, BGP, IGMP

[Frank Knobbe <frank () knobbe us>]

On Sun, 2004-04-04 at 20:21, Aaron wrote:
> I know how to specify networks and hosts in my BPF filter file, though 
> am not sure how to prevent snort from ever seeing GRE, OSPF, IGMP, 
> IPSec traffic, etc...
>
> Does anyone know how?


man tcpdump

Says right there...  ip and not proto 47  (for GRE for example). 50 and
51 for IPSec. See /etc/services for the rest. 

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part