> On Apr 14, 2015, at 10:57 AM, Giedrius Ramas <giedrius.ramas at gmail.com> wrote: > > Hello, we have problems with ERSPAN package. Is there anyway BRO could understand them ? Could you privately provide us a small packet capture of ERSPAN packets? .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/