Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to specify custom BPF filter #478

Merged
merged 1 commit into from
Jul 27, 2017
Merged

Add option to specify custom BPF filter #478

merged 1 commit into from
Jul 27, 2017

Conversation

buger
Copy link
Owner

@buger buger commented Jul 27, 2017

Can be useful in case of non standard network interfaces when like
tunnels or SPAN ports, when IP of interface does not match with IP of
packet.

Can be used to read traffic from multiple ports and interfaces at once
as well.

Example: --input-raw-bpf-filter 'dst port 80'

Can be useful in case of non standard network interfaces when like
tunnels or SPAN ports, when IP of interface does not match with IP of
packet.

Can be used to read traffic from multiple ports and interfaces at once
as well.
@buger buger merged commit cf402a1 into master Jul 27, 2017
@michaelvilensky
Copy link

Just to notice that in case of using "trackResponse", the user will have to manually add filter of src port equals port.

if t.trackResponse {
	bpf = "(tcp dst port " + strconv.Itoa(int(t.port)) + " and (" + bpfDstHost + ")) or (" + "tcp src port " + strconv.Itoa(int(t.port)) + " and (" + bpfSrcHost + "))"
} else {
	bpf = "tcp dst port " + strconv.Itoa(int(t.port)) + " and (" + bpfDstHost + ")"
}

@buger
Copy link
Owner Author

buger commented Jul 27, 2017

That's true, if we simplify: tcp src port 80 and tcp dst port 80

@michaelvilensky
Copy link

Won't work:

sudo ./gor --input-raw-bpf-filter 'tcp dst port 8000' --output-stdout
Version: DEV-1501168199
2017/08/03 12:40:31 Required at least 1 input and 1 output

Also, I'm not sure if you are not making use of port (--input-raw :PORT) in other places in the code.
For instance in file: input_raw.go

i.listener = raw.NewListener(host, port, i.engine, i.trackResponse, i.expire)

@DagW
Copy link

DagW commented Sep 24, 2019

"Can be used to read traffic from multiple ports and interfaces at once
as well."

Im not sure how to use this to listen to multiple ports? Mabe someone can bring som clarity to how to could be done?

@DagW DagW mentioned this pull request Sep 24, 2019
@slimus slimus deleted the bpf-filter branch June 3, 2020 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants