Snort with GRE Tunnel/ERSPAN
"Rajput, Jawad \(CONTR\) via Snort-devel" <[email protected]> Wed, 19 Dec 2018 17:02:37 +0000
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <BN6PR09MB1249F4EA95BCAD49ADFC5CC1ACBE0@BN6PR09MB1249.namprd09.prod.outlook.com> |
Good Morning, I have a question about Snort 2.9.9.0 GRE (Build 56) compatibility with ERSPAN/GRE Tunnel. Snort is not generating any events while fed with ERSPAN. We can see data on the listening interface but Snort is not generating any events. We had the same issue with Bro but we fixed it by editing ini-bare.bro file and changed from encap_hdr_size = 0 line to encap_hdr_size = 44. My question is there a way to ignore first N bytes while inspecting tunnel traffic with Snort? Jawad Rajput System Administrator U.S. Department of Energy IM-62 /Germantown Building HQ Network Security Team Email: [email protected] Office: 301-903-2176 Office: 301-903-3895 _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!