Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some devices without having to use static addresses or DHCP reservations. Can this be done?

share|improve this question

1 Answer

up vote 0 down vote accepted

Snort works higher up on the stack. The protocols it deals with are TCP, UDP, ICMP, and IP.

Check out the manual.

share|improve this answer
Understood - sorry for the noob question, but I'm just getting my feet wet again with Snort (via Security Onion) and haven't absorbed the whole manual yet :) What is the recommended method of handling this situation? Are DHCP reservations my best bet, or should I look in another direction? – Jens Ehrich Nov 15 '12 at 2:38
MAC addresses make sense only on the same broadcast domain. Are you dealing with a small home network with a single router? If not, then DHCP reservations (or ignoring all Dropbox traffic, for example) are the best. – agelastic Nov 19 '12 at 23:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.