Using suricata as IDS for traffic from various networks via ERSPAN

Help
6

Hi,

What Suricata version are you using?

In Suricata 5.0.[3-7], ERSPAN Type 1 is disabled by default. The configuration variable decoder.erspan.typeI.enabled must be set to true (or yes or 1) for this traffic to be inspected. Earlier versions of Suricata do not decode ERSPAN Type 1.

In Suricata 6.0.3 and later, ERSPAN Type 1 is enabled by default.