[Newbie] pppoe

[William Pomian <willish () free fr>]

Hi,

I'm currently trying to use snort 1.7 on a NetBSD-1.5 home server with a
(rp-)pppoe connection. My ethernet card for the modem is fxp0 with 10.0.0.10
as IP adress. I have also a second card to my "home_net" which is rtk0 with
192.168.10.1 as IP adress.

1] When runing snort on rtk0 interface, all works well.

2] When runing snort on fxp0 interface, snort runs, but nothing is logged,
    it seems to not understand pppoe protocol : 

Snort received 2012 packets and dropped 0(0.000%) packets

Breakdown by protocol:                Action Stats:
    TCP: 0          (0.000%)          ALERTS: 0         
    UDP: 0          (0.000%)          LOGGED: 0         
   ICMP: 0          (0.000%)          PASSED: 0         
    ARP: 0          (0.000%)
   IPv6: 0          (0.000%)
    IPX: 0          (0.000%)
  OTHER: 2009       (99.851%)
DISCARD: 0          (0.000%)

3] When runing snort on ppp0 interface, I get the following message :

$ /usr/local/bin/snort -Afull -c /etc/snort/snort.conf -i ppp0

        --== Initializing Snort ==--

Initializing Network Interface ppp0

/usr/local/bin/snort cannot handle data link type 50
Exiting...



I feel a bit lost.... Is there someone to explain me what can I do ?

William Pomian

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users