Re: BPF problem

[Mike Patterson <mike.patterson () uwaterloo ca>]

Following up to myself: I’ve tried various permutations of my BPF filter to no avail. I tried Snort versions 2.9.5.3 
(which is what’s on my old sensor), 2.9.6.0, and 2.9.6.1. Always, Snort says it’s reading my BPF filter, and always, 
it’s including alerts for IPs and networks that are in the filter.

My current filter is of the form:

not (net 1.2.3.4/8 or not net 10.0.0.0/24 or not 172.16.12.1)

I tried a very simple filter - not net 10.0.0.0/24 - and no joy either.

I know that the sensor is not simply looking inside GRE tunnels, like Robert was seeing - verified with tcpdump and one 
of our network engineers.

The only substantial difference between these platforms is the one with functional BPF filters is built on an Endace 
DAG, and the other is built on an Intel X520 with PF_RING+DNA.

I verified that tcpdump (built against libpcap that comes with PF_RING) does accept my filter. I verified that Snort is 
using that same libpcap.

I’m not sure what else to try here. Any suggestions? I can tell barnyard2 to ignore alerts for the IPs I’d like to 
ignore, but it would be nice to save Snort the overhead in processing them (and my disk space).

Mike


------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!