Project

General

Profile

Actions

Feature #1342

closed

Support Cisco erspan traffic

Added by Jay MJ over 9 years ago. Updated almost 9 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Please add support for decoding Cisco erspan traffic, common on some Cisco 5k and 7k devices which do not support rspan or other common forms of port mirroring.

I have provided Victor sample data to provide insight into the unique headers Cisco uses.

Additionally, I have conducted testing with the latest version of snort and have confirmed erspan is working, in addition to the note on their blog: http://blog.snort.org/2013/07/snort-295-is-now-available.html.

I am available to provide testing if needed.

Actions #1

Updated by Victor Julien over 9 years ago

  • Status changed from New to Assigned
  • Target version changed from TBD to 2.1beta4
Actions #2

Updated by Victor Julien almost 9 years ago

  • Target version changed from 2.1beta4 to 3.0RC1
Actions #3

Updated by Victor Julien almost 9 years ago

Could you test this implementation? https://github.com/inliniac/suricata/pull/1498

Actions #4

Updated by Jay MJ almost 9 years ago

Victor Julien wrote:

Could you test this implementation? https://github.com/inliniac/suricata/pull/1498

I should have it in the hopper tonight or tomorrow. Sorry for the delay, not sure why the watch for this issue was off.

Actions #5

Updated by Jay MJ almost 9 years ago

Compiled and did a quick test run. No erspan errors and eve log looks promising. I'll do some comparative analysis between logs with the non-erspan and report back this week. Much appreciation for your work on this.

Actions #6

Updated by Jay MJ almost 9 years ago

Running for several hours with the same rule set and configuration as other mirror. Alert data is matching up, will check http and other event types.

Actions #7

Updated by Victor Julien almost 9 years ago

  • Status changed from Assigned to Closed
  • Priority changed from High to Normal
  • % Done changed from 0 to 100

Thanks for testing!

Actions

Also available in: Atom PDF