Project

General

Profile

Actions

Bug #1382

open

BPF not reflected in suricata.log when using pf-ring

Added by Peter Manev over 7 years ago. Updated over 1 year ago.

Status:
Feedback
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Latest git 2.1dev (rev 1010406) - when using a bpf filter from a file with af-packet - this is reflected in the suricata.log.

....
(runmode-af-packet.c:148) <Info> (ParseAFPConfig) -- Going to use command-line provided bpf filter '( (ip and port 20 or 21..........
....

The same is not true when using BPF with pf-ring.

Actions #1

Updated by Andreas Herz about 6 years ago

  • Assignee set to Anonymous
  • Target version set to TBD
Actions #2

Updated by Andreas Herz over 3 years ago

  • Assignee set to Community Ticket
Actions #3

Updated by Andreas Herz about 3 years ago

  • Status changed from New to Feedback

Is this still an issue?

Actions #4

Updated by Jay MJ about 3 years ago

Andreas Herz wrote:

Is this still an issue?

I checked, it does not appear to be a problem with with printable payload and base64 encoded payload fields in eve logs. Also, suricata generated pcaps appear to be fine.

Using this script to convert the packet field, and it's just garbage (perhaps another issue?). - https://gist.github.com/jermdw/a39d86c36cedbfa9b9a16faed59434e5
I also did try scapy, which doesn't seem think the base64 packet is valid at all.

I think it makes sense to close this and, after I update to latest version of suricata, test more. If still present, open issue for packet field malformed. That does not appear to be related to this erspan issue as it is malformed without that header also.

To conclude, version 4.1.2 does not appear to have the issues with payload and payload printed fields anymore.

Actions #5

Updated by Peter Manev about 3 years ago

@Jay is this the correct issue you have updated ?

Actions #6

Updated by Jay MJ about 3 years ago

Peter Manev wrote:

@Jay is this the correct issue you have updated ?

Whoops, my apologies- no it is not. Please disregard; thank you Peter.

Actions

Also available in: Atom PDF