<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><br></div><div>Hi</div><div><br></div><div>I have some problems retrieving log info about events fired by network packets encapsulate in VLAN. I have monitoring traffic in a tagged vlan, and sometimes, the unified2 logs have info about the VLAN packets, sometimes no.</div><div><br></div><div>In my setup I have a a computer connected to a switch port with a tagged vlan. There are events that were stored in the unified2 with the VLAN info. For example, if Suricata detects traffic that fire up this rule</div><div><br></div><div>ET POLICY Dropbox Client Broadcasting [**] [Classification: Potential Corporate Privacy Violation] [Priority: <br>1] {UDP} 192.168.x.x:17500 -> 255.255.255.255:17500</div><div><br></div><div>Using barnyard2 to obtain the pcap capture of the event, I see the next info:</div><div><br></div><div>08:32:10.545100 68:5b:35:xx:xx:xx > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 199: vlan 2, p 0, ethertype IPv4, 192.168.9.4.17500 > 255.255.2<br>55.255.17500: UDP, length 153</div><div><br></div><div>I see correctly the VLAN information in the packet.</div><div><br></div><div>But when Suricata fire up this rule (downloading a exploit from <a href="http://www.explout-db.com">www.explout-db.com</a>)</div><div><br></div><div>09/09-08:32:13.920616 [**] [1:2011346:7] ET SHELLCODE Possible Unescape %u Shellcode/Heap Spray [**] [Classification: Executable Code was Detected] [Priority: 1] {TCP} 198.58.102.135:80 -> 192.168.x.x:59703</div><div><br></div><div>And I analyze the pcap capture:</div><div><br></div><div>08:32:13.920616 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 471: 198.58.102.135.80 > 192.168.x.x.59703: Flags [], seq 0:417, <br>win 0, length 417</div><div><br></div><div>There aren’t any info about</div><div><br></div><div><ul class="MailOutline"><li>VLAN</li><li>Source MAC</li><li>Destination MAC</li></ul><div><br></div></div><div>I don’t now if this is a configuration issue I have with Suricata or that Suricata doesn’t store VLAN info in certain fired rules.</div><div><br></div><div>Thanks for the help</div><div>Carlos</div><div><br><br></div></body></html>