on Jun 14, 2016Article Content
| Article Number | 000030296 |
| Applies To | RSA Product Set: Security Analytics, RSA NetWitness Logs & Network RSA Product/Service Type: 10G Decoder, Security Analytics UI RSA Version/Condition: 10.4.x, 11.x Platform: CentOS O/S Version: EL6 |
| Issue | After configuring BPF rules on a Security Analytics 10G Decoder, the traffic is not being filtered as expected. |
| Cause | The PFRING driver used with 10G Decoders does not support the use of BPF and therefore will not filter the traffic. |
| Resolution | In order to filter network traffic on a 10G Decoder, a Network Rule must be created rather than using BPF. For example, if ports 553 and 55553 needed to be filtered, rather than using the not (port 553 or 55553) BPF syntax, a network rule similar to the rule shown below should be created.  |
| Notes | More information on configuring Network Rules can be found in the RSA Security Analytics 10.4 User Guide. |