Use a configuration file for bpf
It would be better if suricata can read bpf filters from a configuration file instead of command line with the following format, for example:
"suricata -c /etc/suricata/suricata.yaml -b /etc/suricata/bpf.conf"
And content for bpf.conf config file:
not (dst host 220.127.116.11 and dst port 5405) and
not (dst host 172.17.47.27 and dst port 5405) and
not (dst host 172.17.47.28 and dst port 5405)