[Bro] Bro vlan tagging

Vern Paxson vern at icir.org
Mon Sep 19 17:12:47 PDT 2005


> If you need to filter on a specific tag, I believe pcap.bro will need
> some tweaking.

For a VLAN with tag XX, I think the following might work (in place of
loading vlan.bro):

	redef restrict_filters += { ["vlan"] = "vlan XX" };
	redef encap_hdr_size = 4;

or for a set of VLAN's with tags XX, YY and ZZ:

	redef restrict_filters += { ["vlan"] = "vlan XX or vlan YY or vlan ZZ" };
	redef encap_hdr_size = 4;

- Vern



More information about the Bro mailing list