[Bro] Multi interfaces, one with and one without vlan tagging
Vern Paxson
vern at icir.org
Thu Oct 11 12:02:43 PDT 2007
> I'm just wondering, what will be the best approch to filter vlan tags when I
> have Bro listening on two interfaces, which one needs to have a vlan
> filter and the other doesn't?
Unfortunately you will have to modify Bro's internals to do that.
This is a general problem: when monitoring multiple interfaces, Bro currently
is structured to assume that they're all using the same link layer.
Vern
More information about the Bro
mailing list