I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some devices without having to use static addresses or DHCP reservations. Can this be done?


Snort works higher up on the stack. The protocols it deals with are TCP, UDP, ICMP, and IP.

Check out the manual.

  • Understood - sorry for the noob question, but I'm just getting my feet wet again with Snort (via Security Onion) and haven't absorbed the whole manual yet :) What is the recommended method of handling this situation? Are DHCP reservations my best bet, or should I look in another direction? – Jens Ehrich Nov 15 '12 at 2:38
  • MAC addresses make sense only on the same broadcast domain. Are you dealing with a small home network with a single router? If not, then DHCP reservations (or ignoring all Dropbox traffic, for example) are the best. – Vitaly Osipov Nov 19 '12 at 23:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.