Snort BPF.filter doesn't work

[Robert Millott <robm () millottandassociates com>]

I am trying to filter some data.  I created a rule in my misc.rules that I
know will always fire, ie

alert tcp any any -> 192.168.1.1 80 (msg:"my test rule"; sid: 60999; rev:1)

That rule fires constantly whenever I go to the website at 192.168.1.1

I then create a /etc/snort/bpf.filter that contains one line

!(host 192.168.1.1)

I then edited snort.conf and uncomment the bfp.filter line so it reads

config bpf_file: /etc/snort/bpf.filter

When I run snort and watch /var/log/messages, the above alert continues to
fire.

I also tried using it with the command line option of -F
/etc/snort/bpf.filter. This didn't work either.

I also tried bpf.filter to read
(not host 192.168.1.1)
that didn't work either.

When I start snort, I see the line that reads

Snort BPF Option:
!(host 192.168.1.1)

and yet I still see my above test alert message in my /var/log/messages.

Anyone know why the bpf.filter isn't filtering the data?



-- 
Robert Millott
President, Millott and Associates
(443) 255-3588

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!