BPF syntax help

Jun 22, 2017 10:41 PM

Correct Answer

How about this? Should be a single long line in the filter field:

not ((vlan 300) or (src host 192.168.30.12 and dst host 10.21.32.90 and dst port 902) or (src host 172.14.9.9 and dst host 192.168.30.20 and dst port 10566))

You can also specify tcp dst port if you want as well otherwise above just ignore the protocol and is just port focused:

not ((vlan 300) or (src host 192.168.30.12 and dst host 10.21.32.90 and tcp dst port 902) or (src host 172.14.9.9 and dst host 192.168.30.20 and tcp dst port 10566))

See the reply in context

No one else had this question

Outcomes

Jun 22, 2017 10:41 PM

How about this? Should be a single long line in the filter field:

not ((vlan 300) or (src host 192.168.30.12 and dst host 10.21.32.90 and dst port 902) or (src host 172.14.9.9 and dst host 192.168.30.20 and dst port 10566))

You can also specify tcp dst port if you want as well otherwise above just ignore the protocol and is just port focused:

not ((vlan 300) or (src host 192.168.30.12 and dst host 10.21.32.90 and tcp dst port 902) or (src host 172.14.9.9 and dst host 192.168.30.20 and tcp dst port 10566))

1 person found this helpful

Jun 22, 2017 11:03 PM

If all your traffic is VLAN tagged then you need to specify that as well like so:

not ((vlan 300) or (vlan and src host 192.168.30.12 and dst host 10.21.32.90 and dst port 902) or (vlan and src host 172.14.9.9 and dst host 192.168.30.20 and dst port 10566<tel:10566>))

Jeremy Kerwin @ Naushad Kasu on Jun 22, 2017 11:45 PM

Thanks for that, I'll give it a try.
So even if you're not filtering by VLAN you still need to specifiy the vlan option?

@ Jeremy Kerwin on Jun 22, 2017 11:56 PM

Yes, if you're filtering traffic that is VLAN tagged, you have to tell the BPF that in the filter otherwise it will assume it's not VLAN tagged and the header offset it reads info from will be offset thus never matching the IP, port etc...

Guy Bruneau Jun 23, 2017 8:32 AM

Jeremy,

I assume you have already configured your Decoder/Concentrator/Broker to support VLAN

https://community.rsa.com/docs/DOC-74080

Decoder Service - Explore > decoder > config > capture.device.params > vlan-fix=true

Jeremy Kerwin @ Guy Bruneau on Jun 25, 2017 7:49 AM

I'll need to check, but thanks for the tip.

Jeremy Kerwin @ Guy Bruneau on Jun 26, 2017 9:04 PM

Checked our decoders and we're not supporting VLAN. So my guess is that the VLAN is the BPF doesn't matter.

Guy Bruneau Jun 27, 2017 8:14 AM

capture.device.params = vlan-fix=true is not enabled by default, that is why you need to add it manually if you are using VLAN. If you are not, then adding a BPF filter for VLAN will have no effect. If you want to check to see if there are any VLAN in your network, you can go directly to the decoder and execute:

tcpdump -ni INF vlan -c 1000

If you network has any VLAN, it will show the first 1000 packets and then stop.