[Bro-Dev] #853: problem with VLAN/MPLS packet dumping

Bro Tracker bro at tracker.bro-ids.org
Wed Jul 18 08:04:05 PDT 2012

#853: problem with VLAN/MPLS packet dumping
 Reporter:  jsiwek   |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro2.2
Component:  Bro      |    Version:  git/master
 Keywords:           |
 report from Carsten Langer:

 By the way: you have in my opinion a problem with packet dumping. If the
 trace contains VLAN or MPLS, you strip off VLAN/MPLS and if then you
 dump the packet, then the dumped trace is missing the Ethernet header
 for these packets, while the Ethernet header is still there for packets
 which did not have VLAN/MPLS. My previous GTP-detunneling did the same
 mistake, now I have introduced a fake Ethernet header so that if the
 packet is dumped, is still has its Ethernet header.

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/853>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list