# Multiple encapsulation

**URL:** <https://community.zeek.org/t/multiple-encapsulation/1285>\
**Category:** Zeek\
**Created:** [January 17, 2008, 1:59pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285 "2008-01-17T13:59:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabian\_Hensel](https://avatars.discourse-cdn.com/v4/letter/f/aeb1de/32.png) [@Fabian\_Hensel](https://community.zeek.org/u/Fabian_Hensel)\
**Post date:** [January 17, 2008, 1:59pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285/1 "2008-01-17T13:59:28Z")

</div>

Hi

I have a rather urgent problem. For the evaluation of my diploma  
thesis, I want to run Bro in a DSL-Core Network. The traffic there is  
encapsulated multiple times and Bro does not inspect the real payload  
without adjustment. This is what I could determine from looking at a  
sample trace:

MPLS: 4 bytes  
MPLS: 4 bytes  
IP: 20 bytes  
UDP: 8 bytes  
L2TP: 8 bytes  
PPP: 4 bytes  
Total encapsulation headers: 48 bytes

I tried playing around with parse\_udp\_tunnels, udp\_tunnel\_port and  
encap\_hdr\_size (set to 48), but without any real success. Any chance I  
can get this working?

Regards - Fabian

---

<div class="post-metadata">

**Author:** ![Fabian\_Hensel](https://avatars.discourse-cdn.com/v4/letter/f/aeb1de/32.png) [@Fabian\_Hensel](https://community.zeek.org/u/Fabian_Hensel)\
**Post date:** [January 17, 2008, 4:01pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285/2 "2008-01-17T16:01:38Z")

</div>

I just realized. I had to do a

redef capture\_filters += { ["mpls"] = "mpls"};  
redef encap\_hdr\_size = 48;

Because the outermost encapsulation is MPLS...

- Fabian

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [January 17, 2008, 4:02pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285/3 "2008-01-17T16:02:32Z")

</div>

> sample trace:
> 
> MPLS: 4 bytes  
> MPLS: 4 bytes  
> IP: 20 bytes  
> UDP: 8 bytes  
> L2TP: 8 bytes  
> PPP: 4 bytes  
> Total encapsulation headers: 48 bytes
> 
> I tried playing around with parse\_udp\_tunnels, udp\_tunnel\_port and  
> encap\_hdr\_size (set to 48), but without any real success. Any chance I  
> can get this working?

Bro doesn't have this sort of multiple layers of tunneling built into it  
in a ready-to-use form. In general, you could modify its dynamic protocol  
analysis to do this; but I think easiest would be to hack it in directly,  
right after packets are read, with code hardwired to know how to decapsulate  
the different types of tunneling present in your traces.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [January 17, 2008, 4:14pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285/4 "2008-01-17T16:14:42Z")

</div>

> redef capture\_filters += { ["mpls"] = "mpls"};  
> redef encap\_hdr\_size = 48;
> 
> Because the outermost encapsulation is MPLS...

If the encapsulation is always the same and fixed-sized, then yes, this  
can do the trick. My earlier reply was for cases where the encapsulation  
varies.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [January 17, 2008, 5:03pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285/5 "2008-01-17T17:03:11Z")

</div>

I actually do have an experimental patch for this somewhere. Fabian,  
please send me a mail if you still need it.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/multiple-encapsulation/1285/6 "2022-05-06T15:38:28Z")

</div>