Suricata version: 7.0.8, upgraded from 6.0.20
Operating system: Oracle Linux 9
How you installed Suricata : oracle repository
Hello,
I see that in suricata 7.0.8, following snippet from suricata.yaml was removed.
Do you have any documentation\reasoning\impact analysis of why it was removed?
If it is removed, what is current default value of “vntag” assuming it’s still being used?
vntag:
enabled: false
Thanks in advance!
The enabled setting for vntag has been removed from 7.0.x and greater.
It was introduced in 6.0.x as a feature so we wrapped it with a config setting and with a default value of disabled so that new logs/decode would not occur unless explicitly enabled.
The config setting was removed in 7.0.x (new release).
vntag is always enabled in 7.0.x and later.
Thanks. It’s quite apparent what that functionality is, but is there a page or section on some page which describes what it does officially?
Information about vntag encapsulation is widely available.
Are you asking for details of the vntag technology? Suricata will recognize and decode VNTag encoded frames.
Hello @Jeff_Lucovsky ,
Sorry for late reply. I was just looking for a link from suricata help page to standard page for VNTag. This is just so that I don’t have to guess. I am sure most people are aware of it but it’s just that when you say in your organization that it must be the same vntag technology, they may want some sort of documentation.
Hope that makes sense,
Thanks!