Show me your BPF

[oneCrazyAdmin]

We have a lot of traffic that we are taping. I have seen some suggestions on what to filter out from zeek, suricata, and stenographer.

what I have filtered out is

DNS requests from my internal DNS servers to the google servers in zeek and Suricata
SNMP packets from my monitoring servers to my network devices in zeek and Suricata and Stenographer
SSL packet from stenographer

Are there other network flows that don't make sense to go through and or all of these applications?

[InfosecGoon]

Many people filter out traffic from their internal vulnerability scanners, especially from Suricata. Lots of alerts, all false positives.