Re: mpls

["Paul Melson" <pmelson () gmail com>]

> I need to sniff a link that uses mpls headers. Does
> any one have some advice for doing this successfully?

> From http://www.snort.org/users/roesch/Site/Snort%203.0.html

"...most specifically the new protocol decoders that have been added
for Snort 3.0 including IPv6, MPLS, GRE and 802.1q as well as the new
TCP and IP option decoders."

I'd say Snort 3.0 is your best bet.  Otherwise you're in uncharted
waters, I think.  If you had to use 2.6.x right now, you might be able
to use something like mpls-linux and bridging and then have Snort
attach to the Ethernet bridge interface.  I have no idea if that would
actually work, though.

PaulM

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users