[Oisf-users] Avoid inspecting intra lan traffic with BPF filter expression

Chris Boley ilgtech75 at gmail.com
Thu Jun 30 15:31:21 UTC 2016

I have suricata IDPS setting between a Gig-E Dot1q trunk interface on a
Cisco switch and a Router running dot1q interfaces like a router on a
stick. I set it up in IPS bridge format. I have a bunch of small subnets.

I would like to do some tuning on my BPF filtering.

lets say for sake of discussion subnets of concern are:

When source is VLAN 1( destined for VLAN 2 (

 I need suricata to not scan that traffic and vice versa.

 When source is VLAN 2 ( destined for VLAN 1 ( I need suricata to not scan that traffic.

Then actually scan all other $HOME_NET traffic.

Client / User Subnet

Server subnet

I have several other VLANS in the trunk as well, but it's fine that
suricata scan's them.

Please bear in mind all traffic is VLAN tagged. I saw mentions on the pevma
blog page of specialized expressions for BPF filtering where VLANs were
concerned. I'm looking for some guidance.

I created a 'best guess' filter syntax and I'm sure it's very wrong.

I'm asking for someone to help me get going in the right direction on this:

Thanks in advance!!
My guess at the filter follows:

not((src net and dst net or ( src net and dst net
   (not ((vlan and src net and dst net
or (vlan and src net and dst net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160630/34dd8e58/attachment.html>

More information about the Oisf-users mailing list