Re: Re: Snort X MAC (Who is who?)

[Chris Green <cmg () uab edu>]

"Alex Rodrigues" <alex () bsbnet com> writes:

> I have the same question about netbios names. We use DHCP and I wish to know
> if snort can log IP address and Mac Address. My idea is to make a table with
> all my internal mac's and the users. My problem is to know who is who 2 or 3
> days after the attack or suspicious traffic. Any good idea about ir?

This is stored in the binary log format and stored in the full log
format in a easily parsable way.
-- 
Chris Green <cmg () uab edu>
This is my signature. There are many like it but this one is mine.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users