Project

General

Profile

Actions

Feature #3482

closed

GRE ERSPAN Type 1 Support

Added by Jeff Lucovsky almost 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Immediate
Target version:
Effort:
Difficulty:
medium
Label:
Protocol

Description

[backport issue for 4.1.x] Hello Team

Our client uses Cumulus based switch with ERSPAN configured.
It seems that Cumulus transfer the traffic as encapsulated ERSPAN Type 1 while Suricata support only ERSPAN Type 2.

We found the following:
Suricata decodes only ERSPAN Type 2
https://github.com/OISF/suricata/blob/master/src/decode-erspan.c

<line 60> /* only v1 is tested at this time */
<line 61> if (version != 1)

After removing the condition and allowing Suricata to try and decode different types (tested Type 1), no content was identify due to different header size (32bit for type 1 instead of 64 bit for type 2)
We were able to compile and test a version that supports type 1 instead of type 2.
Since many vendors that are not Cisco may use ERSPAN Type 1, we believe that it is important to have support for both ERSPAN Types in the stable version.

Can you please assist with the issue?

Thank you

Golan


Files

record3.pcap (6.42 KB) record3.pcap Golan Sharon, 12/18/2019 12:51 PM

Related issues 1 (0 open1 closed)

Copied from Feature #3481: GRE ERSPAN Type 1 SupportClosedJeff LucovskyActions
Actions

Also available in: Atom PDF