# Analayzing vlan + normal traffic concurrently **URL:** \ **Category:** Zeek\ **Created:** [June 11, 2010, 11:48pm UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638 "2010-06-11T23:48:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Faisal\_Iqbal](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@Faisal\_Iqbal](https://community.zeek.org/u/Faisal_Iqbal)\ **Post date:** [June 11, 2010, 11:48pm UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638/1 "2010-06-11T23:48:58Z")
Hi, I have few network traces to analyze [for traffic classification] which have vlan headers for certain subnets, and I'm not able to analyze them using bro. I can use "@load vlan" filter but then I'm only able to read vlan traffic, and makes Bro skip on normal [non-vlan] traffic. In my setup, some subnets in my traces are on vlan and further, these subnets have only inbound traffic on vlan while outbound traffic seems to be direct [no vlan header in outbound packets]. Due to above mentioned issue I have to pass each trace twice using different filters and I'm getting two uni-directional flows for each bidirectional flow. I searched Bro mailing list and from the previous posts, I feel that Bro does not support reading vlan and non-vlan traffic concurrently. Is this assumption correct or there is some way/hack to actually analyze them at the same time? Also since I'm using Bro for offline traces, does anyone know a way to somehow modify the trace file to \*fix\* vlan traffic and change it to the normal traffic. Thanks for the help 🙂 -Faisal ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [June 14, 2010, 6:01am UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638/2 "2010-06-14T06:01:24Z")
> ... I feel that Bro > does not support reading vlan and non-vlan traffic concurrently. Is this > assumption correct Yes. > Also since I'm using Bro for offline traces, does anyone know a way to > somehow modify the trace file to \*fix\* vlan traffic and change it to the > normal traffic. There's a handy utility "vstrip", written by Eli Dart, that will take a pcap file and remove VLAN headers in it. I've put a copy at:   [http://www.icir.org/vern/tmp/vstrip.tar](http://www.icir.org/vern/tmp/vstrip.tar) I also have a modified version that can strip out multiple VLAN tags (which we've found some switches can generate). Let me know if you need that one.     Vern ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [June 14, 2010, 4:11pm UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638/3 "2010-06-14T16:11:16Z")
(This was written before Vern's response but I forgot to send it. The tool he mentions is probably the better one.) > I searched Bro mailing list and from the previous posts, I feel that Bro > does not support reading vlan and non-vlan traffic concurrently. Is this > assumption correct or there is some way/hack to actually analyze them at Yes, that's right, there's no support for this yet. It shouldn't be too hard too add though. I have an experimental patch for adding dynamic MPLS decapsulation and VLAN could probably be done in a similar way. Let me know if you're interested in that patch. > Also since I'm using Bro for offline traces, does anyone know a way to > somehow modify the trace file to \*fix\* vlan traffic and change it to the > normal traffic. Google finds this:        [http://www.life-gone-hazy.com/src/tcpdump-tools/tcpdump-strip-vlans.c](http://www.life-gone-hazy.com/src/tcpdump-tools/tcpdump-strip-vlans.c) Haven't tried it though ... Robin ---
**Author:** ![Bernhard\_Ager](https://avatars.discourse-cdn.com/v4/letter/b/35a633/32.png) [@Bernhard\_Ager](https://community.zeek.org/u/Bernhard_Ager)\ **Post date:** [June 14, 2010, 5:05pm UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638/4 "2010-06-14T17:05:14Z")
For the record: tcprewrite \<[http://tcpreplay.synfin.net/wiki/tcprewrite](http://tcpreplay.synfin.net/wiki/tcprewrite)\> also offers an option to strip vlan tags and can do a lot more. I haven't used it yet myself, though.   Bernhard ---
**Author:** ![Faisal\_Iqbal](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@Faisal\_Iqbal](https://community.zeek.org/u/Faisal_Iqbal)\ **Post date:** [June 14, 2010, 10:34pm UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638/5 "2010-06-14T22:34:02Z")
I would definitely be interested in the patch. It'd save me [and I hope several others] the time/space of stripping current and future traces off the vlan tags. For the moment, tcprewrite [pointed by Bernhard Ager] did the job perfectly. I found that vstrip would mess up with the timestamps after stripping but this might be a one off incident. Thanks for the help everyone 🙂 -Faisal ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/analayzing-vlan-normal-traffic-concurrently/1638/6 "2022-05-06T15:39:07Z")