Network Traffic Duplication via SPAN or TAP Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects network traffic duplication, specifically looking for the GRE (Generic Routing Encapsulation) protocol (IP protocol 47) being used in a way that suggests traffic mirroring via SPAN or TAP devices. The rule triggers if 10 or more GRE packets are observed from a single source IP within a 30-second window, flowing from a client to a server.