Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

detect: Recognize ERSPAN Type I packets #4635

Closed
wants to merge 3 commits into from
Closed

detect: Recognize ERSPAN Type I packets #4635

wants to merge 3 commits into from

Conversation

jlucovsky
Copy link
Contributor

Continuation of #4627

[Backport of #4475]

This PR adds support for ERSPAN Type I packets to 5.0.x. It is now configurable (default off) decoder.erspan.typeI.enabled

This document and wireshark were used as a reference for this work.

Link to redmine ticket:3481

Describe changes:

Suricata-verify PR #195

@jlucovsky
decode: Fix typos/spelling
ed6c976 
(cherry picked from commit 427ec4e)
@jlucovsky
decode: Handle ERSPAN Type I
e00de3d 
(cherry picked from commit aec4e9a)
@jlucovsky
decode/erspan: ERSPAN TypeI configurable
ae6beed 
For the backport, ERSPAN TypeI decode is

1. Disabled by default
2. Configurable: `decoder.erspan_typeI.enabled`
@jlucovsky jlucovsky requested a review from a team as a code owner March 5, 2020 13:48
@jlucovsky jlucovsky mentioned this pull request Mar 5, 2020
Closed
@victorjulien victorjulien added this to the 5.0 milestone Mar 5, 2020
@jlucovsky jlucovsky added the backport Backport to released Suricata versions label Mar 20, 2020
@jlucovsky jlucovsky mentioned this pull request Mar 22, 2020
Closed
@jlucovsky
Copy link
Contributor Author

Continued in #4718

@jlucovsky jlucovsky closed this Mar 22, 2020
This was referenced Mar 24, 2020
Closed
Closed
Closed
Closed
Merged
@jlucovsky jlucovsky deleted the 3481/2 branch May 6, 2020 12:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
backport Backport to released Suricata versions
Milestone
5.0
2 participants
@jlucovsky @victorjulien