README.ipip

IP in IP Tunneling

Snort now has the capability of decoding IP in IP encapsulated traffic.

Payload and Delivery header support

Proto Delivery Payload —– ——– ——- IPv4 x x IPv6 x x (only with IPv6 compiled binary)

How to enable the decoder

$ ./configure –enable-gre

Note on multiple encapsulation

Snort does not support more than one encapsulation and will alert if it sees multiple encapsulations. For example, the following will cause Snort to generate an alert:

| Eth | IP | IP | IP | TCP | Payload | ————————————–

Logging

Currently only the encapsulated part of the packet is logged, For example:

| Eth | IP1 | IP2 | TCP | Payload | ———————————–

gets logged as

| Eth | IP2 | TCP | Payload | —————————–

Alerts

Alerts pertaining to the IP in IP decoder fall under the more general case of decoder alerts, with GID of 116. (More general IP alerts are not mentioned here.)

SID Description — ———– 161 Alerts if multiple encapsulations are encountered.