Good day all,
My IDS server receives mirrored traffic from the switch. In addition to classic traffic, I also see pppoe traffic.
But the bro why does not recognize this traffic. What could be the problem?
What kind of customization is needed for the bro to see this type of traffic?
Here are links to samples of this traffic:
What version of Bro are you running? In your pppoe_get2.pcap file Bro 2.5.3 worked fine for me. I got all of the files that I would expect. The reason the other file didn’t work is that your HTTP request in that one doesn’t have the TCP handshake and Bro’s HTTP analyzer is sensitive to not having the handshake. If the handshake is missing Bro will currently not analyze the connection as HTTP.
.Seth
In my system I use version Bro-2.5.2.
Unfortunately I did not find the difference between the two versions, with respect to pppoe