On Thu, Apr 11, 2002 at 11:46:09AM -0400, C.J.O. wrote: > I realize that encapsulation occurs with PPPoE, however snort 1.8.3-5 and > 1.8.4-1 have no difficulties running in IDS mode from the same tap.
That's probably because snort isn't using a libpcap filter of that sort; libpcap (the code to parse and generate code for capture filters is in libpcap) doesn't support generating filters for the PPP part of PPPoE, because nobody's written code to make it do so. > Unfortunately I do not really code and therefore lack the necessary coding > skills to further troubleshoot this. I would appreciate any explanation(s) > or perhaps a future fix or patch. Perhaps someday somebody will write that code. I don't have time to do so in the near to medium-term future. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
