Packet Filtering

L2/L3/L4 Filtering

BPF-like filters can be specified using a subset of the BPF syntax. As the filter expression complexity affects:

  • packet capture speed when used for filtering incoming traffic
  • index complexity and speed when used for filtering dumped traffic

Below we define a set of constraints and allowed expressions.

An expression consists of one or more primitives. Complex filter expressions are built by using AND, OR and NOT operators.

Allowed qualifiers for primitive expressions:

Protocol: ether, ip, ip6, tcp, udp, sctp Direction: src, dst, src or dst, src and dst Type: host, net, port

Allowed qualifiers in index filters when enabling —index-tunnel-content|-G: inner, outer

Other allowed primitives: vlan

Additional constraints for packet capture filters:

  • it is not possible to use the NOT operator.
  • it is possible to use up to two level of nesting with parenthesis
  • on the same nesting level, and inside the same parenthesis, it is not possible to mix different operators

Tricks to speed up index filtering:

  • Use /32 and /24 IPv4
  • Use /128 only IPv6
  • Use exact ports (no port range)
  • Do not use protocol identifiers

Primitive filter examples:

ether host 00:11:22:33:44:55
ether src host 00:11:22:33:44:55

ip host
ip dst host

ip6 host 2001:0db8:85a3:0042:0000:8a2e:0370:7334
ip6 src host 2001:0db8:85a3:0042:0000:8a2e:0370:7334

ip net
ip src net 192.168.1

port 80
udp port 9000
tcp src port 80
vlan 32

Complex capture filter examples:

ip host and
ip src and dst

ip host and tcp port (80 or 443)
(ip host or and (port 80 or 443)

L7 Filtering

L7 filters can also be specified (thanks to the PF_RING FT support in n2disk) to filter packets based on the application protocol. In order to enable L7 filtering all you need to do is to provide a configuration file with –l7-filter-conf <file> with the protocols that you want to discard (‘discard’ action) or dump (‘forward’ action). Since protocol detection is provided by nDPI you can specify all application protocol names supported by the nDPI library. Example:

default = forward

YouTube = discard
Netflix = discard

Please check the PF_RING FT documentation for further information about PF_RING FT and enhanced configurations.