Suricata

Issue 3481 backports ERPAN Type I decode support to 5.0.x and makes it configurable:

decoder.erspan.typeI.enabled

Because of the potential change to the amount of packets being decoded, the decode support was made configurable with the default value providing no ERSPAN Type I decoding.

Future versions of Suricata, 6.0.x and higher, should check the value of the configuration value.

Some possible courses of action, if the configuration value exists:

1. Log an error message stating ERSPAN Type I decode is no longer configurable and exit.
2.Log a warning message stating that ESPAN Type I decode is no longer configurable and continue.
3. Use the configuration setting to determine if ERSPAN Type I decode should be performed.