[Oisf-users] Oisf-users Digest, Vol 88, Issue 29

[Alan Amesbury]

On Mar 29, 2017, at 11:00 (because digests), Victor Julien <lists at inliniac.net> wrote:

[snip]
> Assuming you didn't disable vlan tracking by the flow engine, the
> traffic on both vlans will be treated separately. So no state sharing
> between the tenants.

I didn't think we could disable VLAN tracking because it's used as the tenancy selector.

[snip]
> Yeah, we need to write up more about it. If you're willing to help it
> would be much appreciated.

Since I don't know the underlying details, I'm pretty sure I'd be a bad primary source.  :-)  That said, I'm willing to try to help.  If you've pointers to materials that could be turned into docs (packet walkthroughs, design docs, slide decks from presentations, etc.), I could look at trying to assemble that as documentation, especially since some of those materials might have information I'm seeking that isn't already in the official docs.  (I suspect this is not an easy task, as Suricata looks like a pretty quickly moving target.)

Thanks for your help and response!  I appreciate it!


-- 
Alan Amesbury
University Information Security
http://umn.edu/lookup/amesbury