While Zeek will process vlan-tagged traffic, that traffic has to make it from the interface up to Zeek during the raw packet capture. This won't happen unless the 8021q module is loaded.
Requests:
- load the 8021q module by hand during initial install:
sudo modprobe 8021q || true
- add the line "8021q" to /etc/modules so it's automatically loaded after following boots
echo -e '\n8021q' | sudo tee -a /etc/modules >/dev/null
The above change should have no effect on networks that do not use vlans.
Should this be built into the kernel (as opposed to being a loadable module), step 1 may come back with a failure so we need to add "|| true" to the modprobe command line. (No change is needed for (2) )
While Zeek will process vlan-tagged traffic, that traffic has to make it from the interface up to Zeek during the raw packet capture. This won't happen unless the 8021q module is loaded.
Requests:
sudo modprobe 8021q || true
echo -e '\n8021q' | sudo tee -a /etc/modules >/dev/null
The above change should have no effect on networks that do not use vlans.
Should this be built into the kernel (as opposed to being a loadable module), step 1 may come back with a failure so we need to add "|| true" to the modprobe command line. (No change is needed for (2) )