[Bro] Multiple encapsulation

Vern Paxson vern at icir.org
Thu Jan 17 08:14:42 PST 2008

> redef capture_filters += { ["mpls"] = "mpls"};
> redef encap_hdr_size = 48;
> Because the outermost encapsulation is MPLS...

If the encapsulation is always the same and fixed-sized, then yes, this
can do the trick.  My earlier reply was for cases where the encapsulation


More information about the Bro mailing list