On 10/22/2013 11:36 AM, Doug Burks wrote:
Hi Daniel,
I'm referring to running netsniff-ng, having it accept ERSPAN data,
and write the decapsulated data to a pcap file.
So far there are no such plans, as we do not treat what we get from the
kernel differently. We can certainly open a ticket to not forget about
this idea.
Thanks,
Doug
On Tue, Oct 22, 2013 at 4:23 AM, Daniel Borkmann <[email protected]> wrote:
On 10/21/2013 05:00 PM, Doug Burks wrote:
Hello all,
Have you considered implementing support for decoding ERSPAN? Looks
like gulp and snort currently support this:
Are you referring to the packet dissector or to store the decapsulated
data to a pcap file?
http://staff.washington.edu/corey/gulp/
http://blog.snort.org/2013/07/snort-295-is-now-available.html
Thanks for your consideration!
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
