Traffic Filters

Berkeley Packet Filters (BPF) are used to create Traffic Filters for intrusion detection analysis. By using BPF filters, you can narrow large packet captures down to specific traffic types, simplifying analysis. Both administrative and non-administrative users are allowed to create BPF filters.

Access traffic filters

To access Traffic Filters, you have to go to Administration > Content Filtering > Traffic Filters and the page will open:

The list shows each filter’s Name and Value, with the available Actions on the right. Use the search box above the list to find a filter, and the red button at the end of the search box to clear the search. Rows per page at the bottom of the list sets how many filters are shown on each page.

To add a Traffic Filter, click the Add button:

• In Name field - the name of the Traffic Filter must be provided.
• In Type field - default is custom type.
• In Value field - is used to input custom filter expressions.

You can edit or delete existing filters from the Actions column of the list.

The Truncate button removes every traffic filter in one operation and cannot be undone. Because traffic filters govern what is captured, clearing them changes what the appliance analyses - review the list before using it.

Filter elements

Filter Elements refer to fields in a network protocol header, such as host, port, or TCP port. In BPF syntax, a primitive typically consists of an identifier (ID), which is usually a name or number, preceded by one or more qualifiers.

Type qualifiers

Type qualifiers specify the type of information the ID represents, such as host, net, port, or portrange. If no type qualifier is provided, it defaults to host.

Direction (Dir) qualifiers

Direction qualifiers indicate the direction of traffic relative to the ID. Examples include src, dst, or src or dst.

Protocol (Proto) qualifiers

Protocol qualifiers restrict the filter to a specific protocol, such as ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, TCP, or UDP.

Table 1. Filter Elements

Protocols and operators

You can create complex filter expressions by combining protocols with primitive BPF filters using various modifiers and operators.

The following list outlines the available protocols that can be used:

• arp - Address Resolution Protocol;
• ether - Ethernet;
• fddi - Fiber Distributed Data Interface;
• icmp - Internet Control Message Protocol;
• ip - IPv4;
• ip6 - IPv6;
• link - Link Layer;
• ppp - Point-to-Point Protocol;
• radio - Radio Protocol (commonly used in wireless networking);
• rarp - Reverse Address Resolution Protocol;
• slip - Serial Line Internet Protocol;
• tcp - Transmission Control Protocol;
• tr - Token Ring;
• udp - User Datagram Protocol;
• wlan - Wireless Local Area Network.

Table 2. Valid modifiers and operators

BPF filter examples

The table below provides examples of BPF filters that incorporate operators and modifiers: