# BRO with MPLS + 802.1 Q vlan **URL:** \ **Category:** Zeek\ **Created:** [February 22, 2010, 12:07pm UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589 "2010-02-22T12:07:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Veronica\_Estrada](https://avatars.discourse-cdn.com/v4/letter/v/ba9def/32.png) [@Veronica\_Estrada](https://community.zeek.org/u/Veronica_Estrada)\ **Post date:** [February 22, 2010, 12:07pm UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589/1 "2010-02-22T12:07:56Z")
Hello, I need to process an .erf file with contains mpls packets encapsulated in 802.1 q vlan tunnels. How can I process it with BRO? Do I have to redefine any variable? Thanks in advance! Veronica Estrada Nakao’s Laboratory The University of Tokyo ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [February 22, 2010, 1:09pm UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589/2 "2010-02-22T13:09:45Z")
Bro doesn't support MPLS packets currently. Patches are welcome however. 🙂 I can give you a hand stripping all of the additional headers off-list if you want. It's a little beyond the scope of this list.    .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [February 22, 2010, 5:19pm UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589/3 "2010-02-22T17:19:16Z")
I have one for MPLS actually, it's attached. However, it is old and hasn't seen much testing, which is why it never made it into the distribution. It may also not apply cleanly anymore. The patch adds a new option "mpls\_link" that needs to be redefed to true. Robin [bro-mpls.diff](https://community.zeek.org/uploads/short-url/sFZ53OcKjkvyO6tg2XRbet7eYUE.diff) (3.78 KB) ---
**Author:** ![Veronica\_Estrada](https://avatars.discourse-cdn.com/v4/letter/v/ba9def/32.png) [@Veronica\_Estrada](https://community.zeek.org/u/Veronica_Estrada)\ **Post date:** [February 24, 2010, 7:37am UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589/4 "2010-02-24T07:37:48Z")
Thanks everyone for the fast answer. I patched bro with the file that Robin sent me but I cannot make it works. I have two questions. 1. The patch says " We only support MPLS over DLT\_PPP\_SERIAL links currently." What should I modify if I want to analyze MPLS over 802.1Q/Ethernet? The protocol hierarchy seen in my data is: Frame -Ethernet –802.1Q Virtual LAN —Internet Protocol ----TCP ----UDP ----Data —MPLS ----TCP ----UDP ----Data ----ICMP –Short Frame 1. When I run bro using the patch I run bro using this option have\_mpls=“T” but I get , line 1 (have\_mpls): error, “redef” used but not previously defined Where should I redefine this variable or should I load any special filter? Veronica Estrada Nakao’s Laboratory The University of Tokyo ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [February 26, 2010, 4:09am UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589/5 "2010-02-26T04:09:51Z")
I don't believe that patch is going to work for you because you're MPLS headers are within VLAN headers. Did you try my suggestion? As long as all of your packets have the same headers on them it should work. Looking at your protocol hierarchy though, it looks like not all of your packets have the mpls header. Is that right? Like I offered before though, I can get you setup with something that will strip all of the vlan and mpls headers where appropriate if you need it.    .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-with-mpls-802-1-q-vlan/1589/6 "2022-05-06T15:39:02Z")