Re: EXPERIMENTAL IPv6 decoder available in Snort

 Hi folks,

   I think that there are few reasons to tunnel Ipv6 in Ipv4 packets. Tunneling is one of the many alternatives to implement transition to Ipv6 networks. It is used basically to provide communication between Ipv6 islands through IPv4 infrastructure.
Regards,

   Marcelo.

> Nope, Lance's issue (the honeynet project's, actually) was I
Pv6
> tunneled over IPv4. I used packet captures from the comprom
ised
> honeypot as my test data, so I'm pretty sure about that one.
  I don't
> think there's an option to tunnel v4 over v6, at least not t
hat I was
> able to find in in.h.
st wrote:
>
> > "This decoder is implemented to test Snort's
c being sent
> > inside an IPv6 tunnel) I thought that was Lance's issue. I
 might be
> > mistaken here. In any case, thanks Marty. We love you ;)
> >
> > Cheers, merry Christmas and happy new year.
> >
> > Greg van der Gaast
Pv6 tunneling
> > on a
erimental*
> > version
d to test
> > Snort's
urrently it
> > consists of a decoder and printing module only, so if you
want to test
> > it
> > and see the v6 output, just run 'snort -dv'.
> >
> > If people would like to test the code out and see if it's
working
> > properly,
 into the
> > detection engine, so you can't tell Snort to look at IPv6
addresses or
> > header fields using the rules language yet. It is capable
 of looking
> > for
nneled over
> > IPv4.
interested in
> > seeing if the code is stable and capable of decoding all v
6 traffic
> > without
 generate v6
> > traffic for testing purposes is extremely limited right no
w, so I'm
> > depending on people with access to the right kind of netwo
rks to help
> > out!
rt into the
> > detection engine!
> >
> > -Marty
1616
> > Sourcefire: Professional Snort Sensor and Management Conso
le appliances
> > roesch(at)sourcefire.com - http://www.sourcefire.com
> > Snort: Open Source Network IDS - http://www.snort.org
> >
>
>
 

---
UOL, o melhor da Internet
http://www.uol.com.br/