[Bro] Multi interfaces, one with and one without vlan tagging

Vern Paxson vern at icir.org
Thu Oct 11 12:02:43 PDT 2007


> I'm just wondering, what will be the best approch to filter vlan tags when I
> have Bro listening on two interfaces, which one needs to have a vlan
> filter and the other doesn't?

Unfortunately you will have to modify Bro's internals to do that.

This is a general problem: when monitoring multiple interfaces, Bro currently
is structured to assume that they're all using the same link layer.

		Vern



More information about the Bro mailing list