Re: ERSPAN / GRE - weird log
Justin Azoff <[email protected]> Mon, 4 Nov 2019 10:13:05 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCuj7=4J3fqYdyxkSq6k_3conikeBPhy5OFiM5XQbRpEnJg@mail.gmail.com> |
On Mon, Nov 4, 2019 at 10:07 AM Ralph R. Rye <[email protected]> wrote: > Hoping to see if someone has gotten Zeek to work with ERSPAN span sessions. > > I am doing ERSPAN from a Cisco Nexus switch to a VMware host. I can see > the traffic at the host and do tcpdump captures without any problems. > > When attempting to use Zeek (3.0 or 2.6.3) all I get is entries in the > weird log for the ERSPAN traffic. > 2.6 would definitely not work, but 3.0 has support for this: https://github.com/zeek/zeek/commit/d9533e9616c5e9e34e811b6db57700be8ab61544 What exactly are you getting in the weird.log on 3.0 ? -- Justin _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek