[Snort-users] I must be think why can't I use bpf filters?

Erek Adams erek at ...577...
Wed Jul 10 11:46:02 EDT 2002

On Wed, 10 Jul 2002, Michael Scheidell wrote:

> I guess something is wrong with me and the way I thought I should use bpf
> ifliters (snort 1.86, 1.87beta and 1.87 release)
> If I use a bpf filter I don't get ANY alerts.
> Starting snort like this:
> /usr/local/bin/snort -doDI -m 022 -z \
> -c /usr/local/etc/snort.conf -i rl0 -l /var/log/snort \
> -F /usr/local/share/snort/snort.bpf
> cat /usr/local/share/snort/snort.bpf:
> not src host
> someone answered, and I guess it wasn't clear, I thought they said that it
> was a bug and was being addressed.
> What I want is to filter out all events, alerts (at the bpf level) emenating
> from host
> (no, pass ip any -> any any is not what I want... Im looking to
> eliminate stream, fran ang syn alerts as well).

Have you tried not using a 'bpf file'?  Just with

	snort <options> 'not src host'
	snort <options> 'not (src host'


Erek Adams

More information about the Snort-users mailing list