[Snort-users] BPF filter

Liuhy solar_liu at ...8882...
Mon Apr 21 00:34:01 EDT 2003


Hello everyone,

    In the option of snort command line, there is a "-F", which is followed by a BPF filter file. I have googled it, I only know that it is  the abbreviation of "Berkley Packet Filtering", these cann't give me the answer that I want to get. My questions are: 

1. What is BPF filter? (not introduced in "man tcpdump", "man snort", I cann't enter "man 4 bpf in linux)
2. How can I write BPF filter file? what is the rules to write it?
3. In snort FAQ, there is an example as following: snort <options> ``not ( (icmp[0] = 8 or icmp[0] = 0) and host <foo>)''
    It's similar to a snort command line, is it right? what is the relation of them?

Thanks in advance!

Liuhy
2003/4/21

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030421/d6d3010a/attachment.html>


More information about the Snort-users mailing list