Hi, I have few network traces to analyze [for traffic classification] which have vlan headers for certain subnets, and I'm not able to analyze them using bro. I can use "@load vlan" filter but then I'm only able to read vlan traffic, and makes Bro skip on normal [non-vlan] traffic. In my setup,…

... I feel that Bro does not support reading vlan and non-vlan traffic concurrently. Is this assumption correct Yes. Also since I'm using Bro for offline traces, does anyone know a way to somehow modify the trace file to *fix* vlan traffic and change it to the normal traffic. There's a ha…

(This was written before Vern's response but I forgot to send it. The tool he mentions is probably the better one.) I searched Bro mailing list and from the previous posts, I feel that Bro does not support reading vlan and non-vlan traffic concurrently. Is this assumption correct or there is so…

For the record: tcprewrite < http://tcpreplay.synfin.net/wiki/tcprewrite > also offers an option to strip vlan tags and can do a lot more. I haven't used it yet myself, though. Bernhard

I would definitely be interested in the patch. It'd save me [and I hope several others] the time/space of stripping current and future traces off the vlan tags. For the moment, tcprewrite [pointed by Bernhard Ager] did the job perfectly. I found that vstrip would mess up with the timestamps afte…

Analayzing vlan + normal traffic concurrently

Zeek

Topic		Replies	Views
Ignore 802.1Q vlan-tagging Zeek	3	115	May 6, 2022
is vlan bpf broken in bro Zeek	6	125	May 6, 2022
Bro 0.8 and vlans Zeek	1	76	May 6, 2022
Multi interfaces, one with and one without vlan tagging Zeek	2	101	May 6, 2022
[EXTERNAL] Bro Digest, Vol 108, Issue 12 Zeek	2	107	May 6, 2022

Analayzing vlan + normal traffic concurrently

Related topics