[Bro] BRO with MPLS + 802.1 Q vlan

Seth Hall hall.692 at osu.edu
Thu Feb 25 20:09:51 PST 2010

On Feb 24, 2010, at 2:37 AM, Veronica Estrada wrote:

> Where should I redefine this variable or should I load any special  
> filter?

I don't believe that patch is going to work for you because you're  
MPLS headers are within VLAN headers.  Did you try my suggestion?  As  
long as all of your packets have the same headers on them it should  
work.  Looking at your protocol hierarchy though, it looks like not  
all of your packets have the mpls header.  Is that right?

Like I offered before though, I can get you setup with something that  
will strip all of the vlan and mpls headers where appropriate if you  
need it.


Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721

More information about the Bro mailing list