A question on ethernet padding

[James Lay <jlay () slave-tothe-box net>]

Does snort treat ethernet padding as data?  Wireshark shows that I have 
1 byte of data in a packet after my ethernet and ip headers.  My 
ethernet header, normally 14 bytes, includes 17 bytes of Padding.  Does 
snort consider the padding as data?  Trying to figure out what offset 
and depth to use on this rule.  Hope I'm explaining this well..thanks 
all.

James

------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today. 
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!