[Snort-users] OT: VLANs and ngrep?

Hi there - a bit off-topic, but I'm sure this is a "like minds" case :-)

We have some spanned/monitored ports here where you have to call the
likes of snort and tcpdump with "vlan xxxxx" first in the BPF for them
to "see" the traffic correctly.

Now I'm a big fan of ngrep, but it cannot operate in this mode. It
appears it is hard-wired for beginning all BPFs with "ip" - which means
I can't jam "vlan" in there to make it VLAN-aware.

Has anyone out there found a workaround for this? I partially succeeded
by fiddling with ngrep.c (#define BPF_FILTER_IP "(vlan)") but had
a side effect
of corrupting the IPs reported - so I obviously don't know what I'm
doing :-(


--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users