Arne Welzel fddbdf6232 init-bare: Default Tunnel::max_depth to 4 ...

In AWS GLB environments, the max_depth of 2 is easily reached due to packets
being encapsulated with GENEVE and VXLAN [1]. Any additional encapsulation
layer causes Zeek raise a weird and ignore the inner traffic. Bump the default
maximum depth to 4, while not common it's not unusual either to observe
this in the wild.

[1] https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-packet-formats.html

Closes #3439

2024-01-11 10:22:36 +01:00

261 B

Raw History

View raw