Actions
Feature #6916
opendecoding : add support of IEEE 802.2, 802.3 frames
Description
Suricata v7.0.3 does not decode packets IEEE 802.2, 802.3 with SNAP Header. I suggest implementing this feature.
Updated by Victor Julien 30 days ago
Please attach some pcaps for the header types. Its fine if they are crafted with scapy.
Updated by Alexander Dymov 29 days ago
https://www.cloudshark.org/captures/dfa7559c20c7?filter=!(tcp.stream%20eq%201)
This pcap file contains a lot of IEEE 802.3 Ethernet packets (for example all packets of LLC protocol). In particular, packet 4 from top is similar to my packet which Suricata cannot decode.
My packet:
Destination: ff ff ff ff ff ff
Source: fe f5 1c e7 05 05
Length: 81 00
VLAN header: 00 63 00 08
LLC header: 00 00 f5 81
Data: 80 00 06 04
Hope this helps.
Actions