Project

General

Profile

Actions

Feature #277

closed

Use a configuration file for bpf

Added by Carlos Lopez over 10 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
Effort:
Difficulty:
Label:

Description

It would be better if suricata can read bpf filters from a configuration file instead of command line with the following format, for example:

"suricata -c /etc/suricata/suricata.yaml -b /etc/suricata/bpf.conf"

And content for bpf.conf config file:

not (dst host 239.192.57.11 and dst port 5405) and
not (dst host 172.17.47.27 and dst port 5405) and
not (dst host 172.17.47.28 and dst port 5405)


Files

feature-277.patch (3.15 KB) feature-277.patch patch for load bpf from file delta yeh, 05/25/2011 03:18 AM
Actions #1

Updated by Victor Julien over 10 years ago

  • Assignee set to Anonymous

Implementing this should be fairly simple. Code to load a bpf is already in place, so it's really about adding the command line option and reading the bpf from a file.

Great ticket to start getting to know the Suricata code.

Actions #2

Updated by delta yeh over 10 years ago

Please review attached patch
-----------------------------------------------------------------------------------------------
Author: deltay <> 2011-05-25 16:13:05
Committer: deltay <> 2011-05-25 16:13:05
Parent: 75439863ed864fe73f1fb4d0a1aa20bb4da059c6 (Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.)
Branch: feature-277
Follows: suricata-1.1beta2
Precedes:

#277 Add -b option to specifiy bpf file
Actions #3

Updated by Victor Julien over 10 years ago

  • Status changed from New to Closed
  • Target version set to 1.1beta3
  • % Done changed from 0 to 100

This functionality has been added, thanks Delta Yeh.

Actions #4

Updated by rmkml rmkml about 10 years ago

Hi,
Thx for new option,
but maybe use -F option like tcpdump/snort use already this.
Best Regards
Rmkml

Actions #5

Updated by Victor Julien about 10 years ago

This has already been done, hence the closed bug :)

Actions

Also available in: Atom PDF