[Bro] is vlan bpf broken in bro

Seth Hall seth at corelight.com
Wed Mar 29 08:31:54 PDT 2017


> On Mar 29, 2017, at 11:28 AM, erik clark <philosnef at gmail.com> wrote:
> 
> Libpcap from ntop for pf_ring, on a vmxnet3 interface. ixgbe nics have rxvlan option in ethtool which disables acceleration, but these are all virtual nics; I cant set rx-vlan-offload (bad command, despite being listed in ethtool -k), so I think I am out of luck for filtering.

Ah, that's a much more narrow case than I thought you were referring to.  You might be out of luck without deeper changes to things (or you could use netmap, it might work there!).

  .Seth

--
Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com




More information about the Bro mailing list