Suricata

What would the logic be? Some ratio of non-vlan vs vlan leads to the warning? The stats logging should make it easy to do this already btw, something like a decoder.ethernet vs decoder.vlan check.

Victor Julien wrote in #note-1:

What would the logic be? Some ratio of non-vlan vs vlan leads to the warning? The stats logging should make it easy to do this already btw, something like a decoder.ethernet vs decoder.vlan check.

Another idea would be a decoder-events.rule that could detect it, like "Missing VLAN tag in one direction of a flow" or so.

I have seen this issue in the past as well. You mirrored 5Gbit/s of traffic and ended up confused why only a very small amount of events/alerts are seen. Once you dig into the traffic you spot that one direction of a flow as including the VLAN ID and the other direction was not including it. Only then you recognize it's the `vlan.use-for-tracking: true` option.

A workaround would be an external tool to use a script to do some sort of baseline and detect it (tshark or tcpdump).