Hello,
I wrote a patch (very very crapy code) to enable bro to read IP packet
encapsulate in pppoe. This patch only indicate which header size it
must skip to read IP packet.
I also add a boolean which pass true when the packet is a pppoe
signalisation. In that case, the weird module don't log the packet as
an not IP packet.
If you want to use it, don't forget to put an appropriate filter like
this in you personal bro configuration file :
redef capture_filter += "ether proto 0x8864" ;
The patch is enable here :
http://www.detilly.net/bro-0.8a20-pppoe.patch
Regards,