Yes, another BPF question

[samanosuke26]

Alright, I've tried troubleshooting everything before resorting to yet another BPF question on here but I just can't seem to get these rules to work together. They both work fine separately.

zeek:
bpf:

• not ( udp port 514) or vlan and ( not( udp port 514 ) ) &&
• not (net x.x.x.x/23 and port 9997)

I've tried quotations, &&, ||, ive tried ! instead of "not"

Since trying these at the same time I either get "rendering global sls failed" or it takes the filters but I still see zeek logs for the traffic i'm trying to filter out.

Any ideas?

[samanosuke26]

I've managed to somewhat make it work. It was the combination of the vlan filter that is throwing me off. for now i have just

• not ( udp port 514) &&
• not (net x.x.x.x/23 and port 9997)

Does this not filter out packets that are VLAN tagged?
I'd still like help with keeping the vlan part.

For now I've moved onto my steno filter..
I previously had just 1 long filter for filtering out encrypted web traffic. (from discussion #9131)

-'not((((tcp[((tcp[12] & 0xf0) >> 2)] = 0x14) || (tcp[((tcp[12] & 0xf0) >> 2)] = 0x15) || (tcp[((tcp[12] & 0xf0) >> 2)] = 0x16) || (tcp[((tcp[12] & 0xf0) >> 2)] = 0x17)) && (tcp[((tcp[12] & 0xf0) >> 2)+1] = 0x03)) || (((tcp[((tcp[12] & 0xf0) >> 2)] < 0x14) || (tcp[((tcp[12] & 0xf0) >> 2)] > 0x18)) && (tcp[((tcp[12] & 0xf0) >> 2)+3] = 0x00) && (tcp[((tcp[12] & 0xf0) >> 2)+4] < 0x08)) || (port 1433 and tcp[((tcp[12] & 0xf0) >> 2) + 8] = 0x16))'
Works just fine, but the moment I add && to the end and add the second line from zeek

• not (net x.x.x.x/23 and port 9997)

I get the rendering SLS 'global' failed error...

[cm-ops]

Would you be able to look in the minion log when you get that error? /opt/so/log/salt/minion. Also, would you be able to share the code for that BPF configuration?

[samanosuke26]

I was able to get it working..
I suspect it was the addition of the "vlan" filter on the first rule. For some reason when it checks for "vlan" it messes with any filters behind it. So I simply swamped the two rules:

• not (net x.x.x.x/23 and port 9997) &&
• not ( udp port 514) or vlan and ( not( udp port 514 ) )

This appeared to fix the problem.

As for the Steno bpf.. That was user error. I forgot I had applied a filter directly to the test sensor's sls file and didn't clear it when i was trying to attach the filters to the global.sls. The sensor's sls was overwriting the global.