Packet Filtering

BPF-like filters can be specified using a subset of the BPF syntax. As the filter expression complexity affects:

  • packet capture speed when used for filtering incoming traffic
  • index complexity and speed when used for filtering dumped traffic

Below we define a set of constraints and allowed expressions.

An expression consists of one or more primitives. Complex filter expressions are built by using AND, OR and NOT operators.

Allowed qualifiers for primitive expressions:

Protocol: ether, ip, ip6, tcp, udp, sctp Direction: src, dst, src or dst, src and dst Type: host, net, port

Allowed qualifiers in index filters when enabling —index-tunnel-content|-G: inner, outer

Other allowed primitives: vlan

Additional constraints for packet capture filters:

  • it is not possible to use the NOT operator.
  • it is possible to use up to two level of nesting with parenthesis
  • on the same nesting level, and inside the same parenthesis, it is not possible to mix different operators

Tricks to speed up index filtering:

  • Use /32 and /24 IPv4
  • Use /128 only IPv6
  • Use exact ports (no port range)
  • Do not use protocol identifiers

Primitive filter examples:

ether host 00:11:22:33:44:55
ether src host 00:11:22:33:44:55

ip host 192.168.0.1
ip dst host 192.168.0.1

ip6 host 2001:0db8:85a3:0042:0000:8a2e:0370:7334
ip6 src host 2001:0db8:85a3:0042:0000:8a2e:0370:7334

ip net 192.168.1.0/24
ip src net 192.168.1

port 80
udp port 9000
tcp src port 80
vlan 32

Complex capture filter examples:

ip host 192.168.1.1 and 192.168.1.2
ip src 192.168.1.1 and dst 192.168.1.2

ip host 192.168.1.1 and tcp port (80 or 443)
(ip host 192.168.1.1 or 192.168.1.2) and (port 80 or 443)