# Ignore 802.1Q vlan-tagging

**URL:** <https://community.zeek.org/t/ignore-802-1q-vlan-tagging/1788>\
**Category:** Zeek\
**Created:** [January 18, 2011, 10:44pm UTC](https://community.zeek.org/t/ignore-802-1q-vlan-tagging/1788 "2011-01-18T22:44:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryce\_Boe](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@Bryce\_Boe](https://community.zeek.org/u/Bryce_Boe)\
**Post date:** [January 18, 2011, 10:44pm UTC](https://community.zeek.org/t/ignore-802-1q-vlan-tagging/1788/1 "2011-01-18T22:44:32Z")

</div>

Hi,

I'm curious if anyone has a patch which allows bro to essentially  
ignore the 802.1Q header if present. Alternatively could someone point  
me to where in the code I should look so that I can modify the code  
myself?

Thanks in advance!

-Bryce Boe

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [January 19, 2011, 1:22am UTC](https://community.zeek.org/t/ignore-802-1q-vlan-tagging/1788/2 "2011-01-19T01:22:59Z")

</div>

Add the "vlan" keyword to the beginning of your filter so that BPF passes the packets on to Bro and then load the "vlan" script.

There is a set of changes in the pipe now that will make this a little more straightforward (and do the same thing for MPLS), but what's there now should work fine for you if you are just working with VLAN tagged packets.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![j.sentier206](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@j.sentier206](https://community.zeek.org/u/j.sentier206)\
**Post date:** [January 19, 2011, 1:48pm UTC](https://community.zeek.org/t/ignore-802-1q-vlan-tagging/1788/3 "2011-01-19T13:48:03Z")

</div>

Here is a little patch (to bro1.5.2) I made to get both vlan traffic and regular ethernet traffic at the same time.  
It could prove useful to you

> Message du 19/01/11 02:24  
> De : "Seth Hall"  
> A : "Bryce Boe"  
> Copie à : bro@bro-ids.org  
> Objet : Re: [Bro] Ignore 802.1Q vlan-tagging
> 
> \> I'm curious if anyone has a patch which allows bro to essentially  
> \> ignore the 802.1Q header if present. Alternatively could someone point  
> \> me to where in the code I should look so that I can modify the code  
> \> myself?
> 
> Add the "vlan" keyword to the beginning of your filter so that BPF passes the packets on to Bro and then load the "vlan" script.
> 
> There is a set of changes in the pipe now that will make this a little more straightforward (and do the same thing for MPLS), but what's there now should work fine for you if you are just working with VLAN tagged packets.
> 
> .Seth
> 
> --  
> Seth Hall  
> International Computer Science Institute  
> (Bro) because everyone has a network  
> [http://www.bro-ids.org/](http://www.bro-ids.org/)
> 
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_  
> Bro mailing list  
> bro@bro-ids.org  
> [mailman.icsi.berkeley.edu Mailing Lists](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro)

Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ?  
Je crée ma boîte mail www.laposte.net

[vlan.diff](https://community.zeek.org/uploads/short-url/ryiXwkMCcBiqzePfj0rJmav5i9c.diff) (1.93 KB)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/ignore-802-1q-vlan-tagging/1788/4 "2022-05-06T15:39:24Z")

</div>