Re: Disable IPV6 in Snort 2.9.4.6

[Michael Süess <michael.sueess () basis06 ch>]

Hi


After switching from Snort 2.9.3.1 to Snort 2.9.4.6 I always get
UNIFIED2_IDS_EVENT_IPV6_VLAN (105) events instead of the non-IPV events 
I got when using Snort 2.9.3.1 (-;

But when sniffing with Snort 2.9.4.6, it only shows IP4 entries (see 
sniff-v.out)

As an example, i use the following snort config (snort.conf)

My tools can only parse IP4 unified snort output, so i need a way to get 
back the non-IPV6 events....


Thx in Advance for any help

--
Michael Sueess                           Senior Software Engineer

basis06 AG, Birkenweg 61, CH-3013 Bern - Fon +41 31 311 32 22
http://www.basis06.ch - source of smart business

Keine News verpassen? http://www.basis06.ch/newsletter-registration.html
Schon gebloggt? http://blog.basis06.ch


On 09.08.2013 17:17, Joel Esler wrote:
> Support for IPv6 was hardened in Snort 2.9.4, and is always enabled now.
> Reference from the release notes/email when Snort 2.9.4 was released:
>
> * Consolidation of IPv6 -- now only a single build supports both
>    IPv4 & IPv6, and removal of the IPv4 "only" code paths.
>
> Also, note that MPLS is enabled by default so the --enable-mpls is
> not needed.
>
>
> On Aug 9, 2013, at 3:58 AM, Michael Süess <michael.sueess () basis06 ch> wrote:
>
> > Hi
> >
> >
> > I updated from snort 2.9.3.1 to snort 2.9.4.6 and tried to configure
> > snort 2.9.4.6 with --disable-ipv6:
> >
> > ./configure --enable-mpls --enable-perfprofiling --disable-ipv6
> >
> > but unfortunately the --disable-ipv6 is not available anymore:
> > > ...
> > > configure: WARNING: unrecognized options: --disable-ipv6
> >
> > how can i configure/run snort 2.9.4.6 with disabling ipv6?
> >
> >
> >
> > thx in advance
> > --
> > Michael Sueess                           Senior Software Engineer
> >
> > basis06 AG, Birkenweg 61, CH-3013 Bern - Fon +41 31 311 32 22
> > http://www.basis06.ch - source of smart business
> >
> > Keine News verpassen? http://www.basis06.ch/newsletter-registration.html
> > Schon gebloggt? http://blog.basis06.ch
> >
> > ------------------------------------------------------------------------------
> > Get 100% visibility into Java/.NET code with AppDynamics Lite!
> > It's a free troubleshooting tool designed for production.
> > Get down to code-level detail for bottlenecks, with <2% overhead.
> > Download for free and get started troubleshooting in minutes.
> > http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest Snort news!

Attachment: snort-v.out
Description:

Attachment: snort.conf
Description:

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and 
AppDynamics. Performance Central is your source for news, insights, 
analysis and resources for efficient Application Performance Management. 
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!