zeek/testing/btest/Baseline/core.tunnels.max-depth/dns.log.cut
Arne Welzel fddbdf6232 init-bare: Default Tunnel::max_depth to 4
In AWS GLB environments, the max_depth of 2 is easily reached due to packets
being encapsulated with GENEVE and VXLAN [1]. Any additional encapsulation
layer causes Zeek raise a weird and ignore the inner traffic. Bump the default
maximum depth to 4, while not common it's not unusual either to observe
this in the wild.

[1] https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-packet-formats.html

Closes #3439
2024-01-11 10:22:36 +01:00

3 lines
218 B
Text

### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
uid id.orig_h id.resp_p id.resp_h id.resp_p query
CtPZjS20MLrsMUOJi2 4.4.4.4 53 4.4.4.9 53 www.bbc.com