Re: Snort with ERSPAN

Snort should handle version 1 / type 2 as shown in that link.  If you have
version 1 / type 1, that isn=B9t supported currently.  We can look into tha=
t.

Just to confirm, do you have type 1 as defined here?

    https://tools.ietf.org/html/draft-foschiano-erspan-03#section-4.1

Thanks
Russ

On 8/5/19, 8:34 AM, "Snort-devel on behalf of Giles Coochey via
Snort-devel" <[email protected] on behalf of
[email protected]> wrote:

>I've been doing this by using rcdcap to decode the ERSPAN packets.
>
>As described here:
>https://brezular.com/2015/05/03/decapsulation-erspan-traffic-with-open-sou
>rce-tools/
>
>On 05/08/2019 13:30, Rajput, Jawad (CONTR) via Snort-devel wrote:
>> Good Morning,
>>
>> We are trying to test Snort with ERSPAN version 1 and type 1, Snort
>>absolutely does not detect anything. I can manually take off first 38
>>bytes using "editcap" utility and run the PCAP through Snort with
>>positive hits.
>>
>> My question is, is there a way to configure/compile snort to skip first
>>38 bytes while inspecting a traffic? Unfortunately, I cannot share a
>>sample PCAP per organization policy.
>>
>> Jawad Rajput, CISSP
>> System Administrator
>> U.S. Department of Energy
>> IM-62 /Germantown Building
>> HQ Network Security Team
>> Email: [email protected]
>> Office: 301-903-2176
>> Office: 301-903-3895
>>
>> _______________________________________________
>> Snort-devel mailing list
>> [email protected]
>> https://lists.snort.org/mailman/listinfo/snort-devel
>>
>> Please visit http://blog.snort.org for the latest news about Snort!
>_______________________________________________
>Snort-devel mailing list
>[email protected]
>https://lists.snort.org/mailman/listinfo/snort-devel
>
>Please visit http://blog.snort.org for the latest news about Snort!

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!