[Bro] is vlan bpf broken in bro

[erik clark]

Libpcap from ntop for pf_ring, on a vmxnet3 interface. ixgbe nics have
rxvlan option in ethtool which disables acceleration, but these are all
virtual nics; I cant set rx-vlan-offload (bad command, despite being listed
in ethtool -k), so I think I am out of luck for filtering.


On Wed, Mar 29, 2017 at 11:14 AM, Seth Hall <seth at corelight.com> wrote:

>
> > On Mar 29, 2017, at 10:17 AM, erik clark <philosnef at gmail.com> wrote:
> >
> > The short of it: Will bro respect vlan filters, or does it have the same
> issue that tcpdump and libpcap seem to have?
>
> If it's acquiring packets through straight libpcap on linux and linux has
> an issue with vlan handling, then yes, you will have the same problem.  If
> you are using some alternate packet handling mechanism then the problem
> with likely not be there.  Are you using the default libpcap on your distro?
>
>   .Seth
>
> --
> Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170329/5c13a840/attachment.html