Project

General

Profile

Actions
Copy link

Bug #2478

open
PB OD

PCAP logging does not include 802.1q header when using af-packet

Bug #2478: PCAP logging does not include 802.1q header when using af-packet

Added by Paul Bakoyiannis about 8 years ago. Updated 9 months ago.

Status:
Feedback
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:
Protocol

Description

PCAP files created while using af-packet v2/3 on tagged traffic do not include the vlan header. This is because the header is removed by the kernel and passed to us in an auxiliary data structure.

Related issues 2 (1 open — 1 closed)

Related to Suricata - Bug #1780: VLAN tags not forwarded in afpacket inline modeClosedEric LeblondActions
Related to Suricata - Bug #2934: VLAN tags stripped when saving pcap logNewOISF DevActions

AH Updated by Andreas Herz about 8 years ago Actions
Copy link
 #1

  • Target version set to TBD

VJ Updated by Victor Julien about 7 years ago Actions
Copy link
 #2

Similar to the AF_PACKET IPS mode we could forge the header back into the packet before it's written to disk.

AH Updated by Andreas Herz over 6 years ago Actions
Copy link
 #3

  • Related to Bug #1780: VLAN tags not forwarded in afpacket inline mode added

AH Updated by Andreas Herz over 6 years ago Actions
Copy link
 #4

  • Related to Bug #2934: VLAN tags stripped when saving pcap log added

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #5

  • Status changed from New to Feedback

Paul, are you planning to submit a PR for this?

VJ Updated by Victor Julien about 6 years ago Actions
Copy link
 #6

  • Label Protocol added

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #7

  • Assignee changed from Paul Bakoyiannis to OISF Dev

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #8

  • Affected Versions 8.0.0 added
Actions
Copy link

Also available in: PDF Atom