0

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other traffic not web related.

running tcpdump/windump I can do this simply tcpdump -w notwww.pcap not 192.168.4.4 not port 80 not port 443

But I cannot find documentation or a location to put this in the config.

2 Answers 2

1

I am a little confused by your question. When I have used a scheuled TCPDUMP, I have always just called it from the cronjob. I dont believe there is a config file to apply filters.

Also I believe you are missing your AND clauses in the above statement.

I believe your statement should look more like this:

tcpdump -vv not src 192.168.4.4 and not dst port 80 and not dst port 443 -w notwww.pcap

You could also use the OR clause to simplify your statement

tcpdump -vv not src 192.168.4.4 and not (dst port 80 or 443) -w notwww.pcap

Hope this helps.

3
  • Snort/Security onion has it running as part of the "package" That would be the easy way, but I'm trying to keep the changes in the Snort/Security onion configs.
    – tkrabec
    Jan 30, 2014 at 15:35
  • Ahh, I see, I am not familiar with that specific package.... thank you for the clarification.
    – DaffyDuc
    Jan 30, 2014 at 19:29
  • Neither was I until earlier today. It's all about learning.
    – tkrabec
    Jan 30, 2014 at 19:30
0

This is done with bpf Berkley Packet Filter.
the config is located in your /etc/nsm/$sensorname/bpf.conf I've not found a really good resource how to write them but for my requirements this worked

! host 192.168.4.4 && ! port 80 && ! port 443

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .