# is vlan bpf broken in bro **URL:** \ **Category:** Zeek\ **Created:** [March 29, 2017, 2:17pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749 "2017-03-29T14:17:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [March 29, 2017, 2:17pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/1 "2017-03-29T14:17:56Z")
Per this thread: [http://serverfault.com/questions/544651/vlan-tags-not-shown-in-packet-capture-linux-via-tcpdump](http://serverfault.com/questions/544651/vlan-tags-not-shown-in-packet-capture-linux-via-tcpdump) tcpdump can’t process vlan filters. Testing confirms this. From link: ```auto tcpdump -i eth0 -Uw - | tcpdump -en -r - vlan 4 ``` `This works and displays only vlan 4 stuff. The reverse does not:` `tcpdump -i eth0 -Uw - "vlan 4" |tcpdump -en -r -` `This displays ALL vlans tagged in the traffic, and not just vlan 4.` This is on RHEL 7. Apparently there are some issues with x86\_64 vlan acceleration. The short of it: Will bro respect vlan filters, or does it have the same issue that tcpdump and libpcap seem to have? ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [March 29, 2017, 3:14pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/2 "2017-03-29T15:14:42Z")
If it's acquiring packets through straight libpcap on linux and linux has an issue with vlan handling, then yes, you will have the same problem. If you are using some alternate packet handling mechanism then the problem with likely not be there. Are you using the default libpcap on your distro?   .Seth ---
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [March 29, 2017, 3:28pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/3 "2017-03-29T15:28:59Z")
Libpcap from ntop for pf\_ring, on a vmxnet3 interface. ixgbe nics have rxvlan option in ethtool which disables acceleration, but these are all virtual nics; I cant set rx-vlan-offload (bad command, despite being listed in ethtool -k), so I think I am out of luck for filtering. ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [March 29, 2017, 3:31pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/4 "2017-03-29T15:31:54Z")
Ah, that's a much more narrow case than I thought you were referring to. You might be out of luck without deeper changes to things (or you could use netmap, it might work there!).   .Seth ---
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [March 29, 2017, 3:50pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/5 "2017-03-29T15:50:50Z")
Ive actually tried this with stock libpcap, and have the same results. I just checked an ixgbe nic I have laying around, and I get the same results, without any option to set rxvlan… From the various boxes I have tried so far (e1000e, ixgbe, vmxnet3), all of these exhibit the same filtering problem with vlans. Maybe netmap can handle it, but it doesnt appear that libpcap (pf\_ring or not) can properly handle vlan filtering… Since we are going with af\_packet, netmap is unfortunately off the table. ---
**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\ **Post date:** [March 29, 2017, 4:06pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/6 "2017-03-29T16:06:22Z")
> Since we are going with af\_packet, netmap is > unfortunately off the table. In case you are using AF\_Packet, unfortunately VLANs won't be available in Bro. See [GitHub - zeek/zeek-af\_packet-plugin: Plugin providing native AF\_Packet support for Zeek.](https://github.com/J-Gras/bro-af_packet-plugin#limitations) Jan ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/is-vlan-bpf-broken-in-bro/4749/7 "2022-05-06T15:44:47Z")