PCAP not retreiving 443 traffic

[BradMic]

I get alerts about traffic on port 443 but it never returns anything when I select Actions > PCAP. For traffic on other ports Actions > PCAP works just fine. Although this really feels like a BPF, I do not have any BPFs configured for port 443 in the steno stanza of the global or minion salt pillars. Any ideas?

[cm-ops]

If you open one of those up what is the traffic?

[BradMic]

On the sensor, the /opt/so/conf/steno/config file looks just like that except for the following differences:
MaxDirectoryFiles is set to 150000
The Flags line includes a --filter= option followed by a long string of hexadecimal numbers.

[cm-ops]

Do you have other steno BPFs enabled?

[BradMic]

yes

[BradMic]

I deleted the entire --filter option in /opt/so/conf/steno/config and ran salt "sensor_name" state.highstate

[cm-ops]

The BPF should be set in the pillar file on the manager (global or minion depending on where you set it). Then when the pcap state runs it will put the BPF in the config based on what is set there. If you remove from /opt/so/conf, salt will place the BPF back when the state is run.