Re: Snort log: Source MAC address record

[Ayodele Okeowo <aymacro () gmail com>]

Thanks YM for your prompt response. I will check this out tonight and also
read more articles I can grab online to tune the results.

Ayo


On Mon, Mar 11, 2013 at 3:59 PM, Y M <snort () outlook com> wrote:

>  You may use the -e switch when running Snort. I haven't used it
> personally, but it may be worth a shot.
>
> "-e   Display the second layer header info"
>
> Also see this conversation titled "Snorting the MAC address", good
> information:
>
> http://seclists.org/snort/2002/q2/426
>
> YM
>  ------------------------------
> From: Ayodele Okeowo <aymacro () gmail com>
> Sent: 3/11/2013 9:29 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Snort log: Source MAC address record
>
>  Hello,
>
> Can Snort also record the MAC address of a machine sourcing from my
> network? If not, is there any snort module that can help Snort?
>
> Ayo
------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester  
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the  
endpoint security space. For insight on selecting the right partner to 
tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!