search

firnsy / barnyard2

Barnyard2 is a dedicated spooler for Snort's unified2 binary output format.
GNU General Public License v2.0
344 stars 190 forks source link

barnyard2 u2 alert_fast using GRE IP, not encapsulated IP. #258

Open brianp9906 opened 4 years ago

brianp9906 commented 4 years ago

Hello, I'm running Snort 2.9.16 and using "output unified2: filename snort.u2, limit 128". When I use "u2spewfoo" I can see the encapsulated source/dest IP information, but when barnyard writes it to snort-alert.log using "output alert_fast: snort-alert.log" I'm only getting the GRE source IP information. What am I missing?

BTW, I did compile barnyard2 with "./configure --enable-gre"

Thank you