Project

General

Profile

Actions

Feature #3481

closed

GRE ERSPAN Type 1 Support

Added by Jeff Lucovsky over 4 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
medium
Label:
Needs backport, Protocol

Description

[backport issue for 5.0.x] Hello Team

Our client uses Cumulus based switch with ERSPAN configured.
It seems that Cumulus transfer the traffic as encapsulated ERSPAN Type 1 while Suricata support only ERSPAN Type 2.

We found the following:
Suricata decodes only ERSPAN Type 2
https://github.com/OISF/suricata/blob/master/src/decode-erspan.c

<line 60> /* only v1 is tested at this time */
<line 61> if (version != 1)

After removing the condition and allowing Suricata to try and decode different types (tested Type 1), no content was identify due to different header size (32bit for type 1 instead of 64 bit for type 2)
We were able to compile and test a version that supports type 1 instead of type 2.
Since many vendors that are not Cisco may use ERSPAN Type 1, we believe that it is important to have support for both ERSPAN Types in the stable version.

Can you please assist with the issue?

Thank you

Golan


Files

record3.pcap (6.42 KB) record3.pcap Golan Sharon, 12/18/2019 12:51 PM

Related issues 3 (0 open3 closed)

Copied from Suricata - Feature #3422: GRE ERSPAN Type 1 SupportClosedJeff LucovskyActions
Copied to Suricata - Feature #3482: GRE ERSPAN Type 1 SupportClosedShivani BhardwajActions
Copied to Suricata - Task #3515: GRE ERSPAN Type 1 Support configurationClosedJeff LucovskyActions
Actions #1

Updated by Jeff Lucovsky over 4 years ago

Actions #2

Updated by Jeff Lucovsky over 4 years ago

Actions #3

Updated by Jeff Lucovsky over 4 years ago

ERSPAN Type I handling should be disabled by default.

Actions #4

Updated by Jeff Lucovsky over 4 years ago

  • Status changed from New to In Review
Actions #5

Updated by Jeff Lucovsky over 4 years ago

  • Copied to Task #3515: GRE ERSPAN Type 1 Support configuration added
Actions #6

Updated by Jeff Lucovsky over 4 years ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF