Re: BPF Filters

[Y M <snort () outlook com>]

> From: bturnbough () belcan com
> To: snort-users () lists sourceforge net
> Date: Fri, 14 Nov 2014 21:06:56 +0000
> Subject: [Snort-users] BPF Filters
>
> Hi All,
>
> I've been running snort for quite a while now with no problems.  I would like to set up a BPF filter to ignore ESP 
> encapsulated traffic.
>
> As a test, I created a file called snort-em1.bpf and placed the following rule in it:
>
> !(src net 192.168.10.0/24 && dst port 22)
>
>
> Then I attempted to start snort:
>
> /usr/sbin/snort -i em1 -u snort -g snort -c /etc/snort/snort-em1.conf -f /etc/snort/bpfs/snort-em1.bpf -l 
> /var/log/snort/em1
Shouldn't "-f" above be "-F"?
 -f         Turn off fflush() calls after binary log writes -F<bpf>   Read BPF filters from file <bpf>

YM
> However, snort refuses to start:
>
> ERROR: Can't set DAQ BPF filter to '/etc/snort/bpfs/snort-em1.bpf' (pcap_daq_set_filter: pcap_compile: syntax error)!
>
>
> Can someone please help me?
>
> Brad
> _____________________________________________________________ This e-mail transmission contains information that is 
> confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail 
> in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any 
> disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the 
> message immediately by informing the sender that the message was misdirected. After replying, please erase it from 
> your computer system. Your assistance in correcting this error is appreciated.
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Comprehensive Server Monitoring with Site24x7.
Monitor 10 servers for $9/Month.
Get alerted through email, SMS, voice calls or mobile push notifications.
Take corrective actions from your mobile device.
http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!