[Bro] erspan decapsulation

Seth Hall seth at icir.org
Thu Apr 16 13:14:57 PDT 2015

> On Apr 16, 2015, at 11:15 AM, Kristoffer Björk <kristoffer.bjork at gmail.com> wrote:
> However, to me it looks like 50bytes instead of 22 bytes? Like in this: https://staff.washington.edu/corey/gulp/conv.c
> But i guess bro deencapsulates the gre tunnel for you?

Yep.  Bro supports GRE.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list