[Bro] erspan decapsulation

[Seth Hall]

> On Apr 16, 2015, at 11:15 AM, Kristoffer Björk <kristoffer.bjork at gmail.com> wrote:
> 
> However, to me it looks like 50bytes instead of 22 bytes? Like in this: https://staff.washington.edu/corey/gulp/conv.c
> But i guess bro deencapsulates the gre tunnel for you?

Yep.  Bro supports GRE.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/