Traffic Filters

Berkeley Packet Filters (BPF) are a powerful tool for creating Traffic Filters in intrusion detection analysis. By using BPF filters, large packet captures can be efficiently narrowed down to specific traffic types, making the analysis process more streamlined. Both administrative and non-administrative users are allowed to create BPF filters.

Access Traffic Filters

To access Traffic Filters, you have to go to Adminitration > Traffic Filters and the page will open:

To add a Traffic Filter, you have to press the button:

• In Name field - the name of the Traffic Filter must be provided.
• In Type field - default is custom type.
• In Value field - is used to input custom filter expressions.

Filter Elements

Filter Elements refer to fields in a network protocol header, such as host, port, or TCP port. In BPF syntax, a primitive typically consists of an identifier (ID), which is usually a name or number, preceded by one or more qualifiers.

Type Qualifiers

Type qualifiers specify the type of information the ID represents, such as host, net, port, or portrange. If no type qualifier is provided, it defaults to host.

Direction (Dir) Qualifiers

Direction qualifiers indicate the direction of traffic relative to the ID. Examples include src, dst, or src or dst.

Protocol (Proto) Qualifiers

Protocol qualifiers restrict the filter to a specific protocol, such as ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, TCP, or UDP.

Table 1. Filter Elements

Protocols and Operators

Complex filter expressions can be created by combining protocols with primitive BPF filters using various modifiers and operators.

The following list outlines the available protocols that can be used:

• arp - Address Resolution Protocol;
• ether - Ethernet;
• fddi - Fiber Distributed Data Interface;
• icmp - Internet Control Message Protocol;
• ip - IPv4;
• ip6 - IPv6;
• link - Link Layer;
• ppp - Point-to-Point Protocol;
• radio - Radio Protocol (commonly used in wireless networking);
• rarp - Reverse Address Resolution Protocol;
• slip - Serial Line Internet Protocol;
• tcp - Transmission Control Protocol;
• tr - Token Ring;
• udp - User Datagram Protocol;
• wlan - Wireless Local Area Network.

Table 2. Valid modifiers and operators

BPF Filter Examples

The table below provides examples of BPF filters that incorporate operators and modifiers: