BPF-like filters can be specified using a subset of the BPF syntax. As the filter expression complexity affects:
- packet capture speed when used for filtering incoming traffic
- index complexity and speed when used for filtering dumped traffic
Below we define a set of constraints and allowed expressions.
An expression consists of one or more primitives. Complex filter expressions are built by using AND, OR and NOT operators.
Allowed qualifiers for primitive expressions:
Protocol: ether, ip, ip6, tcp, udp, sctp Direction: src, dst, src or dst, src and dst Type: host, net, port
Allowed qualifiers in index filters when enabling —index-tunnel-content|-G: inner, outer
Other allowed primitives: vlan
Additional constraints for packet capture filters:
- it is not possible to use the NOT operator.
- it is possible to use up to two level of nesting with parenthesis
- on the same nesting level, and inside the same parenthesis, it is not possible to mix different operators
Tricks to speed up index filtering:
- Use /32 and /24 IPv4
- Use /128 only IPv6
- Use exact ports (no port range)
- Do not use protocol identifiers
Primitive filter examples:
ether host 00:11:22:33:44:55 ether src host 00:11:22:33:44:55 ip host 192.168.0.1 ip dst host 192.168.0.1 ip6 host 2001:0db8:85a3:0042:0000:8a2e:0370:7334 ip6 src host 2001:0db8:85a3:0042:0000:8a2e:0370:7334 ip net 192.168.1.0/24 ip src net 192.168.1 port 80 udp port 9000 tcp src port 80 vlan 32
Complex capture filter examples:
ip host 192.168.1.1 and 192.168.1.2 ip src 192.168.1.1 and dst 192.168.1.2 ip host 192.168.1.1 and tcp port (80 or 443) (ip host 192.168.1.1 or 192.168.1.2) and (port 80 or 443)
L7 filters can also be specified (thanks to the PF_RING FT support in n2disk) to filter packets based on the application protocol. In order to enable L7 filtering all you need to do is to provide a configuration file with –l7-filter-conf <file> with the protocols that you want to discard (‘discard’ action) or dump (‘forward’ action). Since protocol detection is provided by nDPI you can specify all application protocol names supported by the nDPI library. Example:
[global] default = forward [filter] YouTube = discard Netflix = discard
Please check the PF_RING FT documentation for further information about PF_RING FT and enhanced configurations.