[Snort-users] Daemonlogger and BPF

[Randal T. RIoux]

I have a question about the file format for bpf filtering with Daemonlogger.

The syntax isn't described anywhere. However, this is what I know.

"port 80 and port 8080" works fine for the -f command line inclusion.

"port 80 and port 8080 and port 8181" throws this error:

expression rejects all packets

So, I guess my question really is: what is the proper formatting/syntax
for BPF usage in Daemonlogger?

Thanks!
Randy

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

[Jason Brvenik]

Wouldn't that be no packets because there can only be two ports in any
given conversation using them?

If you want all packets for port 80, 8080, and 8081 then you need to use "or"

port 80 or port 8080 or port 8081

--
Regards,

Jason.

[Martin Roesch]

Hi Randy,

Your expression rejects all packets, as Jason said. I think you want
to use "or" instead of "and" there.

Daemonlogger uses the same BPF file format as all libpcap-derived
programs (tcpdump, snort, etc). I guess I should mention that in the
docs. :) If you want to read up on it before I get an update out the
door just 'man tcpdump' and it should all be in there.

Marty

On Mon, Jun 7, 2010 at 12:15 AM, Randal T. RIoux <ra...@procyonlabs.com> wrote:
> I have a question about the file format for bpf filtering with Daemonlogger.
>
> The syntax isn't described anywhere. However, this is what I know.
>
> "port 80 and port 8080" works fine for the -f command line inclusion.
>
> "port 80 and port 8080 and port 8181" throws this error:
>
>    expression rejects all packets
>
> So, I guess my question really is: what is the proper formatting/syntax
> for BPF usage in Daemonlogger?
>
> Thanks!
> Randy
>
> ------------------------------------------------------------------------------
> ThinkGeek and WIRED's GeekDad team up for the Ultimate
> GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
> lucky parental unit.  See the prize list and enter to win:
> http://p.sf.net/sfu/thinkgeek-promo
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>

--
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source IDP - http://www.snort.org

[Randal T. RIoux]

Aye! That makes sense. I shouldn't do these things when I'm overtired :-)

Thanks to you and Jason... I got it now.

Enjoy your evening!

Randy