Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Load 8021q module to recognize vlan-tagged traffic on networks with vlans #39

Open
william-stearns opened this issue Jan 6, 2023 · 1 comment
Assignees

Comments

@william-stearns
Copy link
Contributor

While Zeek will process vlan-tagged traffic, that traffic has to make it from the interface up to Zeek during the raw packet capture. This won't happen unless the 8021q module is loaded.
Requests:

  1. load the 8021q module by hand during initial install:
    sudo modprobe 8021q || true
  2. add the line "8021q" to /etc/modules so it's automatically loaded after following boots
    echo -e '\n8021q' | sudo tee -a /etc/modules >/dev/null
    The above change should have no effect on networks that do not use vlans.
    Should this be built into the kernel (as opposed to being a loadable module), step 1 may come back with a failure so we need to add "|| true" to the modprobe command line. (No change is needed for (2) )
@william-stearns william-stearns self-assigned this Jan 6, 2023
@william-stearns
Copy link
Contributor Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant