GRE (IP protocol 47) and IP-in-IP (protocol 4) wrap one IP packet inside another with almost no overhead. They are normal between routers, but unexpected from endpoints and servers. Because they are not TCP or UDP, they are skipped by port-based monitoring and often by allow-list firewalls that treat them as infrastructure traffic.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| IP protocol 47 (GRE) or 4 (IPIP) or 41 (IPv6 encapsulation) leaving the network | Firewall, NetFlow, Zeek | T1572 |
| Zeek tunnel.log records for GRE or IP-in-IP between external endpoints | Zeek tunnel.log | T1095 |
| ip tunnel add or ip link add type gre/ipip on a host | auditd, EDR | T1572 |
| Traffic from a host to an external address with only protocol 47/4 and no application sessions | NetFlow | T1095 |
| Firewall policies that permit any IP protocol outbound | Policy review | T1572 |
Edge and Flow Detection
The first control is an inventory of the places GRE and IPIP are legitimate: WAN routers, cloud VPN gateways and a few vendor links. Anything else crossing the boundary is exceptional. Zeek decodes encapsulated traffic into tunnel.log, which reports the tunnel type and both endpoints:
# Splunk (Zeek tunnel.log) - external GRE / IP-in-IP tunnels
index=zeek sourcetype=bro_tunnel tunnel_type IN ("Tunnel::GRE","Tunnel::IP")
| stats count AS events, min(_time) AS first, max(_time) AS last
BY id.orig_h, id.resp_h, tunnel_type
| where NOT cidrmatch("10.0.0.0/8", 'id.resp_h')
| sort - events
# Linux edge: log, then review, any encapsulation protocols
iptables -I FORWARD -p 47 -j LOG --log-prefix "GRE-FWD "
iptables -I FORWARD -p 4 -j LOG --log-prefix "IPIP-FWD "
# tune/validate: add source and destination allow-lists for sanctioned
# router and cloud-gateway peers before turning logging into alerting.
Host Tunnel Interfaces
Creating a GRE or IPIP tunnel on Linux needs root and leaves a clear command or netlink trail. A workstation or application server with no routing role should never create one:
title: Linux GRE or IPIP Tunnel Interface Creation
logsource:
category: process_creation
product: linux
detection:
selection_ip:
Image|endswith: '/ip'
selection_tunnel:
CommandLine|contains:
- 'tunnel add'
- 'link add'
selection_mode:
CommandLine|contains:
- 'mode gre'
- 'mode ipip'
- 'type gre'
- 'type ipip'
- 'type sit'
condition: selection_ip and selection_tunnel and selection_mode
level: high
# tune/validate: container and network-automation hosts create tunnels by
# design; scope by host role.
- Deny IP protocols other than TCP, UDP and ICMP outbound by default and permit exceptions explicitly.
- Alert on any non-router host emitting protocol 47 or 4 to an external address.
- Check cloud security groups, which often default-allow protocol 47 or all protocols on internal ranges.
- Combine with host interface inventory to find tunnel devices with no matching network design.
Use Zeek tunnel.log documentation, your firewall’s protocol-level logs and policy export, SigmaHQ Linux process-creation content and Elastic network rules for unusual IP protocols. Always baseline your own environment — sanctioned router and VPN gateway links will appear and must be allow-listed.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts