I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some devices without having to use static addresses or DHCP reservations. Can this be done?
Snort works higher up on the stack. The protocols it deals with are TCP, UDP, ICMP, and IP.
Check out the manual.