You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Nov 4, 2022. It is now read-only.
Seems like most network utilities are now building in support for ERSPAN decapsulation. From what I've been able to test so far, there is no reliable way to decapsulate ERSPAN traffic before stenographer grabs it. We're trying to send ERSPAN Type II traffic directly from VMWare vDS to a Linux host that's being used for NIDS (Security Onion), that uses Steno to capture the packets.
Seems like most network utilities are now building in support for ERSPAN decapsulation. From what I've been able to test so far, there is no reliable way to decapsulate ERSPAN traffic before stenographer grabs it. We're trying to send ERSPAN Type II traffic directly from VMWare vDS to a Linux host that's being used for NIDS (Security Onion), that uses Steno to capture the packets.