Re: Mac-Address

[Joel Esler <jesler () sourcefire com>]

You probably won’t get the mac address of the host.  You will only get the mac address of the device that last handled 
the packet before Snort saw it.


On Aug 19, 2013, at 9:08 AM, Abid Ayoub <abid.ayoub () gmail com> wrote:

> Thanks.
>
> So what i need is to save in snort database, when an attack is deteckted, the mac-addresses of host.
> So how can i do that ?
>
> Regards,
> Abid
>
>
> 2013/8/19 Joel Esler <jesler () sourcefire com>
> Snort can dump the last mac address that it sees when it sniffs the packet, use the “-e” command line tag.
>
> --
> Joel Esler
> Senior Research Engineer, VRT
> OpenSource Community Manager
> Sourcefire
>
> On Aug 19, 2013, at 6:30 AM, Abid Ayoub <abid.ayoub () gmail com> wrote:
>
> > Hi,
> >
> > can snort show the mac-address of hosts , with oder instead of the ip-address?
> >
> > Regards,
> > Abid
> > ------------------------------------------------------------------------------
> > Get 100% visibility into Java/.NET code with AppDynamics Lite!
> > It's a free troubleshooting tool designed for production.
> > Get down to code-level detail for bottlenecks, with <2% overhead. 
> > Download for free and get started troubleshooting in minutes. 
> > http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk_______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead. 
Download for free and get started troubleshooting in minutes. 
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!