OK, thanks! Doug On Wed, Oct 23, 2013 at 3:13 AM, Daniel Borkmann <[email protected]> wrote: > On 10/22/2013 11:36 AM, Doug Burks wrote: >> >> Hi Daniel, >> >> I'm referring to running netsniff-ng, having it accept ERSPAN data, >> and write the decapsulated data to a pcap file. > > > So far there are no such plans, as we do not treat what we get from the > kernel differently. We can certainly open a ticket to not forget about > this idea. > > >> Thanks, >> Doug >> >> On Tue, Oct 22, 2013 at 4:23 AM, Daniel Borkmann <[email protected]> >> wrote: >>> >>> On 10/21/2013 05:00 PM, Doug Burks wrote: >>>> >>>> >>>> Hello all, >>>> >>>> Have you considered implementing support for decoding ERSPAN? Looks >>>> like gulp and snort currently support this: >>> >>> >>> >>> Are you referring to the packet dissector or to store the decapsulated >>> data to a pcap file? >>> >>> >>>> http://staff.washington.edu/corey/gulp/ >>>> http://blog.snort.org/2013/07/snort-295-is-now-available.html >>>> >>>> Thanks for your consideration! >>>> >>> >> >> >> >
-- Doug Burks http://securityonion.blogspot.com -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
