{"action":"created","issue":{"url":"https://api.github.com/repos/wanduow/libprotoident/issues/14","repository_url":"https://api.github.com/repos/wanduow/libprotoident","labels_url":"https://api.github.com/repos/wanduow/libprotoident/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/wanduow/libprotoident/issues/14/comments","events_url":"https://api.github.com/repos/wanduow/libprotoident/issues/14/events","html_url":"https://github.com/wanduow/libprotoident/issues/14","id":153907408,"number":14,"title":"Does this take care of VLAN headers as well?","user":{"login":"mazkopolo","id":2704255,"avatar_url":"https://avatars.githubusercontent.com/u/2704255?v=3","gravatar_id":"","url":"https://api.github.com/users/mazkopolo","html_url":"https://github.com/mazkopolo","followers_url":"https://api.github.com/users/mazkopolo/followers","following_url":"https://api.github.com/users/mazkopolo/following{/other_user}","gists_url":"https://api.github.com/users/mazkopolo/gists{/gist_id}","starred_url":"https://api.github.com/users/mazkopolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mazkopolo/subscriptions","organizations_url":"https://api.github.com/users/mazkopolo/orgs","repos_url":"https://api.github.com/users/mazkopolo/repos","events_url":"https://api.github.com/users/mazkopolo/events{/privacy}","received_events_url":"https://api.github.com/users/mazkopolo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-05-10T01:51:15Z","updated_at":"2016-05-12T21:15:28Z","closed_at":null,"body":"Hi, I am not sure I should log it as an issue or not. Here is the problem.\r\nWhen I use bro IDS to parse my pcap file and compare my results with lib_protoident I see totally different results. I was wondering if the current version of lib_protoident takes VLAN headers into consideration or not?!"},"comment":{"url":"https://api.github.com/repos/wanduow/libprotoident/issues/comments/218888132","html_url":"https://github.com/wanduow/libprotoident/issues/14#issuecomment-218888132","issue_url":"https://api.github.com/repos/wanduow/libprotoident/issues/14","id":218888132,"user":{"login":"salcock","id":3212148,"avatar_url":"https://avatars.githubusercontent.com/u/3212148?v=3","gravatar_id":"","url":"https://api.github.com/users/salcock","html_url":"https://github.com/salcock","followers_url":"https://api.github.com/users/salcock/followers","following_url":"https://api.github.com/users/salcock/following{/other_user}","gists_url":"https://api.github.com/users/salcock/gists{/gist_id}","starred_url":"https://api.github.com/users/salcock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salcock/subscriptions","organizations_url":"https://api.github.com/users/salcock/orgs","repos_url":"https://api.github.com/users/salcock/repos","events_url":"https://api.github.com/users/salcock/events{/privacy}","received_events_url":"https://api.github.com/users/salcock/received_events","type":"User","site_admin":false},"created_at":"2016-05-12T21:15:28Z","updated_at":"2016-05-12T21:15:28Z","body":"I can't speak for BRO, but libprotoident ignores TCP flows that did not start with the time period covered by the pcap file (i.e. flows were the TCP handshake occurred before the capture started). This is because libprotoident relies on seeing the first payload bearing packets for the flow -- if we don't see the handshake then we can't guarantee we're looking at the right packets.\r\n\r\nThis is probably the reason why you are seeing less flows and bytes than other tools."}}