![snort logo](/images/snort-logo.png)
Snort mailing list archives
QinQ and 802.1ah headers
From: jan hugo prins <jhp () jhprins org>
Date: Thu, 19 Oct 2017 10:01:18 +0200
Hello I'm trying to setup a snort instance to monitor some inbound traffic to my production network. We use an Avaya SPBM cloud and all servers are connected to this cloud. In the VSP7024 switches we use, I can create a port-mirroring instance and forward all traffic coming from a MAC address (in this case the BGP router of my provider) to a port on the switch and then I wanted to put snort behind this port and let it listen to all inbound traffic. When I started snort I noticed that snort was not seeing any traffic, at least not something that it could handle / analyze. I then started tcpdump to see what the traffic looked like and I saw that both the 802.1ah header with the service tag and the vlan header with the vlan tag were still in the packets. I would assume that snort can handle vlan tags, but what about 802.1ah headers with service tags, does snort know what to do with them? I thought about creating a subinterface on my linux box to strip the 802.1ah header but so far I have not found a linux driver that can do this for me. Jan Hugo _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- QinQ and 802.1ah headers jan hugo prins (Oct 19)
- Re: QinQ and 802.1ah headers Al Lewis (allewi) via Snort-users (Oct 19)
- Re: QinQ and 802.1ah headers jan hugo prins (Oct 19)
- Re: QinQ and 802.1ah headers Al Lewis (allewi) via Snort-users (Oct 19)
- Re: QinQ and 802.1ah headers Jan Hugo Prins (Oct 19)
- Re: QinQ and 802.1ah headers Al Lewis (allewi) via Snort-users (Oct 19)
- Re: QinQ and 802.1ah headers Russ via Snort-users (Oct 19)
- Re: QinQ and 802.1ah headers jan hugo prins (Oct 19)
- Re: QinQ and 802.1ah headers Russ via Snort-users (Oct 24)
- Re: QinQ and 802.1ah headers jan hugo prins (Oct 19)
- Re: QinQ and 802.1ah headers Al Lewis (allewi) via Snort-users (Oct 19)