Feature #2816: vlan: support more than 2 layers - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #2816

closed

vlan: support more than 2 layers

Added by Tony Gumbrell about 5 years ago. Updated 11 months ago.

Status:

Closed

Priority:

Normal

Assignee:

Jeff Lucovsky

Target version:

8.0.0-beta1

Effort:

Difficulty:

Label:

Protocol

Description

When running 2 x 8100 vlan tags within my data the packets are parsed neatly into the eve.json log file in the format "vlan":[123,987]. We have just added a third tag to this data and despite being able to validate the tags in pcaps, the traffic is no longer be parsed into the eve.json log at all.

Is this a system limitation or a bug?

Thanks

Related issues 1 (1 open — 0 closed)

Actions

Copy link

Updated by Victor Julien about 5 years ago

Currently Suricata will only deal with a max of 2 vlans per packet.

Actions

Copy link

Updated by Tony Gumbrell about 5 years ago

Thanks for the speedy response. Is it on the roadmap to resolve this?

Actions

Copy link

Updated by Victor Julien about 5 years ago

Tracker changed from Bug to Feature
Subject changed from 3 VLAN tags breaks eve.json to vlan: support more than 2 layers
Affected Versions deleted (~~4.1~~)

Not yet, but you're not the first to bring this up. So I think it should be addressed.

Actions

Copy link