BPF-like filters can be specified using a subset of the BPF syntax. As the filter expression complexity affects:
- packet capture speed when used for filtering incoming traffic
- index complexity and speed when used for filtering dumped traffic
Below we define a set of constraints and allowed expressions.
An expression consists of one or more primitives. Complex filter expressions are built by using AND, OR and NOT operators.
Allowed qualifiers for primitive expressions:
Protocol: ether, ip, ip6, tcp, udp, sctp Direction: src, dst, src or dst, src and dst Type: host, net, port
Allowed qualifiers in index filters when enabling —index-tunnel-content|-G: inner, outer
Other allowed primitives: vlan
Additional constraints for packet capture filters:
- it is not possible to use the NOT operator.
- it is possible to use up to two level of nesting with parenthesis
- on the same nesting level, and inside the same parenthesis, it is not possible to mix different operators
Tricks to speed up index filtering:
- Use /32 and /24 IPv4
- Use /128 only IPv6
- Use exact ports (no port range)
- Do not use protocol identifiers
Primitive filter examples:
ether host 00:11:22:33:44:55 ether src host 00:11:22:33:44:55 ip host 192.168.0.1 ip dst host 192.168.0.1 ip6 host 2001:0db8:85a3:0042:0000:8a2e:0370:7334 ip6 src host 2001:0db8:85a3:0042:0000:8a2e:0370:7334 ip net 192.168.1.0/24 ip src net 192.168.1 port 80 udp port 9000 tcp src port 80 vlan 32
Complex capture filter examples:
ip host 192.168.1.1 and 192.168.1.2 ip src 192.168.1.1 and dst 192.168.1.2 ip host 192.168.1.1 and tcp port (80 or 443) (ip host 192.168.1.1 or 192.168.1.2) and (port 80 or 443)