[Bro] is vlan bpf broken in bro
seth at corelight.com
Wed Mar 29 08:31:54 PDT 2017
> On Mar 29, 2017, at 11:28 AM, erik clark <philosnef at gmail.com> wrote:
> Libpcap from ntop for pf_ring, on a vmxnet3 interface. ixgbe nics have rxvlan option in ethtool which disables acceleration, but these are all virtual nics; I cant set rx-vlan-offload (bad command, despite being listed in ethtool -k), so I think I am out of luck for filtering.
Ah, that's a much more narrow case than I thought you were referring to. You might be out of luck without deeper changes to things (or you could use netmap, it might work there!).
Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com
More information about the Bro