Packet Filtering

BPF-like filters can be specified using a subset of the BPF syntax. As the filter expression complexity affects:

  • packet capture speed when used for filtering incoming traffic
  • index complexity and speed when used for filtering dumped traffic

Below we define a set of constraints and allowed expressions.

An expression consists of one or more primitives. Complex filter expressions are built by using AND, OR and NOT operators.

Allowed qualifiers for primitive expressions:

Protocol: ether, ip, ip6, tcp, udp, sctp Direction: src, dst, src or dst, src and dst Type: host, net, port

Allowed qualifiers in index filters when enabling —index-tunnel-content|-G: inner, outer

Other allowed primitives: vlan

Additional constraints for packet capture filters:

  • it is not possible to use the NOT operator.
  • it is possible to use up to two level of nesting with parenthesis
  • on the same nesting level, and inside the same parenthesis, it is not possible to mix different operators

Tricks to speed up index filtering:

  • Use /32 and /24 IPv4
  • Use /128 only IPv6
  • Use exact ports (no port range)
  • Do not use protocol identifiers

Primitive filter examples:

ether host 00:11:22:33:44:55
ether src host 00:11:22:33:44:55

ip host
ip dst host

ip6 host 2001:0db8:85a3:0042:0000:8a2e:0370:7334
ip6 src host 2001:0db8:85a3:0042:0000:8a2e:0370:7334

ip net
ip src net 192.168.1

port 80
udp port 9000
tcp src port 80
vlan 32

Complex capture filter examples:

ip host and
ip src and dst

ip host and tcp port (80 or 443)
(ip host or and (port 80 or 443)