VLAN tags

[hosom]

When Stenographer records traffic, it appears to strip the outermost VLAN tag. I don't know if I would consider this a bug, but I definitely wasn't expecting this. I am aware of several environments that use QinQ tagging to signal which taps traffic is coming from and it would be convenient to make this a configurable setting.

[aeppert]

When Stenographer records traffic, it appears to strip the outermost VLAN tag. I don't know if I would consider this a bug, but I definitely wasn't expecting this. I am aware of several environments that use QinQ tagging to signal which taps traffic is coming from and it would be convenient to make this a configurable setting.

I am assuming this is due to Stenographer using AF_PACKET. The VLAN tags are stripped at a lower layer and, unfortunately with my work on a few other things using AF_PACKET, it isn’t trivial to put them back together. It is possible, but with a decent performance impact as they have to be, per packet, re-applied. It is, perhaps, possible and may make sense to maintain a small state-store that could be built overtime and thus the performance penalties would smooth over the running time of stenographer.

[capton586]

Is there any way to avoid this issue?

[satta]

Maybe it could help disabling the NIC's VLAN offloading so the VLAN tags make it into AF_PACKET?

sudo ethtool -K <interface> rxvlan off