Project

General

Profile

Actions

Support #2972

closed

How can I get the mac at the NFQ mode

Added by John Smith almost 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

When I start suricata as NFQ mode,as suricata -c /etc/suricata/suricata.yaml -q 0 -q 1. I can't get the mac address from the package,because if a package is from NFQ,there is no mac bytes when I use wireshark to get the package.

Actions

Also available in: Atom PDF