Re: BPF for ECN Bits

[Joe McAlerney <joey () SiliconDefense com>]

I wrote this one a while back.  It was tested, and seems to work. 
Please let me know if you find it is not doing the job.

# snort <command options> not 'tcp[13] & 192 != 0'

-Joe M.

-- 
|   Joe McAlerney     joey () silicondefense com   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

Erickson Brent W KPWA wrote:
> Goodmorning,
>
> Does anyone have a working example of a bpf filter for ignoring ECN bits ?
> I have searched the Snort forum and could not find anything although I
> remember the topic being discussed in the past.
> I am trying the have the Snort portscan pre-processor ignore SMTP connects
> with the ecn or reserved bits set. Or ignore all ecn or reserved bits.
> Thank you for your help,
> Brent Erickson
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users