Unable to parse Control Word or EoMPLS Frames

cleesmith / unifiedbeat

Unifiedbeat reads records from Unified2 binary files generated by network intrusion detection software and indexes the records in Elasticsearch.

MIT License

30 stars 14 forks source link

Unable to parse Control Word or EoMPLS Frames #12

Closed rmatulat closed 7 years ago

rmatulat commented 7 years ago

Hi, I recognized that Unifiedbeat is unable to decode control word and/or EoMPLS (Pseudo Wire) frames after the Bottom Of Stack MPLS Frame. It just expects IPv4 or IPv6 - so following CW or PW frames are causing an "Unable to guess protocol of packet data" error. Kind regards Ralf

cleesmith commented 7 years ago

That's not something I anticipated or have experience with ... so if you have a fix please feel free to do so and make a pull request. Thanks.

rmatulat commented 7 years ago

In that case I first have to deep-dive into Golang. For our environment I q&d patched the vendor/github.com/google/gopacket/layers/mpls.go file, but I guess for a more convenient solution I have to invest some extra time. I'll have a look at this.