Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some devices without having to use static addresses or DHCP reservations. Can this be done?

share|improve this question
up vote 0 down vote accepted

Snort works higher up on the stack. The protocols it deals with are TCP, UDP, ICMP, and IP.

Check out the manual.

share|improve this answer
Understood - sorry for the noob question, but I'm just getting my feet wet again with Snort (via Security Onion) and haven't absorbed the whole manual yet :) What is the recommended method of handling this situation? Are DHCP reservations my best bet, or should I look in another direction? – Jens Ehrich Nov 15 '12 at 2:38
MAC addresses make sense only on the same broadcast domain. Are you dealing with a small home network with a single router? If not, then DHCP reservations (or ignoring all Dropbox traffic, for example) are the best. – Vitaly Osipov Nov 19 '12 at 23:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.