Filters

The configuration of monitoring ports can use multiple filter types. The standard probe appliance only supports flow export target filters, but additional modules such as Packet Investigator use their own filters. Each filter type has its own syntax and semantics. Flow export target filters are described below. For more information about the other filter types, refer to the relevant module documentation.

Flow export targets filter

Flow export targets filters control which exported flow records produced by a monitoring port are forwarded to individual configured targets.

Click New Filter to create a filter. After you enter the Name, Type, Filter, and optional Description, you can attach the filter to monitoring port targets. Usage shows how many targets use the filter, and the filter detail view lists the targets. Click the pencil icon to edit a filter or the trash bin icon to delete it. You can only delete a filter if there are no targets using it. Click Reload to refresh usage information for all filters.

Syntax

A Flow export targets filter is an ordered set of rules similar to simple firewall rules. Each rule either matches (accepts) or rejects flow records based on L2–L4 attributes (IP addresses, ports, protocols, and VLAN). The evaluation result determines whether a matching flow record is exported to the target or not.

You can define two filter types: fast filter and standard filter. The fast filter is intended for very long lists of subnets, IP addresses, or intervals (for example, abroad traffic). It processes thousands of rules efficiently. The standard filter allows more complex, granular rules but in smaller numbers. The two filter types can be combined.

You can use comments in filters. They are delimited with the hashtag (#) character and end of line. You can use the not keyword to invert the whole rule (not individual parts).

The monitoring port filter is evaluated in the same way as firewalls do. Rules of fast and standard filters are processed in descending order and they cannot overlap. The fast filter block must be first, followed by the standard filter block (both blocks are optional). If the packet passes through the fast filter it goes to the standard filter. The first matching rule stops the evaluation. A rule beginning with the not keyword is evaluated in the same manner as the firewall rule REJECT; rules without not are evaluated as the rule ACCEPT. If there is no matching rule for a packet, it is not processed. In the firewall logic, a default rule (REJECT ALL) is applied at the end of the list. This behavior can be changed by adding the keyword any on the end of the standard filter (this cannot be used for the fast filter). If this keyword is present, all packets that do not match any rule will be processed. In the firewall logic, a default rule (ACCEPT ALL) is applied at the end of the list. The result of the whole filter is evaluated as a result of logical AND of fast filter and standard filter results. If the filter is empty or no filter is given to the monitoring port, then no filtering is done and the monitoring port process all packets.

If you want to apply negative logic to a fast filter, you can apply it globally on the whole filter by declaring "global fast not".

Filter syntax

Standard filter rule elements

Standard filter examples

# Various examples
src addr 192.168.1.1-192.168.1.255 proto tcp dst port 80
addr 192.168.2.0/24 proto udp port 1-1024
dst addr 192.168.3.1
not port 80
not dst addr 192.168.3.1 dst port 80 proto icmp
src addr 2001:718::/32 dst port 42
addr 0.0.0.0/0 ipproto ipv4
addr 147.251.0.0/16
dst addr 192.168.0.0-192.168.3.42
not ipproto ipv4
src addr 192.168.3.100-192.168.3.110 proto tcp vlan 64

# Blocks packets from 192.168.3.0/24 net to 192.168.6.0/24 net
not src addr 192.168.3.0/24 dst addr 192.168.6.0/24

# Process packets from IP 1.2.3.4 except port 80
not addr 1.2.3.4 port 80
addr 1.2.3.4

# Exclude internal communication (for subnet 172.16.0.0/12) and allow communication with the internet for a specific subnet (172.16.1.0/24)
not src addr 172.16.0.0/12 dst addr 172.16.0.0/12
addr 172.16.1.0/24

Fast filter examples

# Allow all from networks below
fast addr 192.168.3.0/24
fast addr 192.168.255.0/24
fast addr 192.168.253.0/24
fast addr 192.168.251.0/24
fast addr 192.168.249.0/24
fast addr 192.168.247.0/24
fast addr 192.168.245.0/24
fast addr 192.168.243.0/24
fast addr 192.168.241.0/24
fast addr 192.168.239.0/24
fast addr 192.168.237.0/24
fast addr 192.168.235.0/24
fast addr 192.168.233.0/24
# And process all packets except HTTP
not proto tcp port 80
any

Negative filter example

# Allow all traffic except networks below
global fast not
fast addr 192.168.3.0/24
fast addr 192.168.4.0/24

IDS Probe filters

IDS Probe filters specify which traffic the IDS Probe module processes. You can filter traffic based on IPv4/IPv6 addresses, networks, VLAN tags, MPLS labels, MAC addresses, ports, and selected protocols (TCP, UDP, ICMPv4, ICMPv6).

Syntax

A filter expression consists of one or more rules combined with the operators not, and, and or (case-insensitive), and parentheses for grouping. Operator precedence is not > and > or.

Each line in a multiline filter acts as an implicit or between top-level expressions. The # character introduces a line comment; everything from # to the end of the line is ignored. Comments may appear at the start of a line or inline after an expression.

The following table lists the supported filter categories:

The ip and net keywords support both IPv4 and IPv6 addresses and subnets in CIDR notation. The net keyword is an alias for ip and is accepted for backward compatibility.

The keywords outer and inner in VLAN and MPLS rules determine whether the outer or inner tag in a packet should be used to evaluate the rule. When no scope keyword is given, the rule matches any VLAN tag or MPLS label in the packet. The "N/A" value (case-insensitive) matches the absence of a VLAN or MPLS layer and is only valid without a scope keyword.

Examples

# Match a single IP address
ip 192.168.1.10

# Match a network
net 10.0.0.0/8

# Match an IPv6 network
ip 2001:db8::/32

# Match a VLAN range and a MAC address
vlan 100-199 or mac aa:bb:cc:dd:ee:01

# Match HTTPS traffic
port 443 and proto tcp

# Match traffic with no VLAN tag
vlan "N/A"

# Match traffic on an outer VLAN with MPLS present
not mpls "N/A" and outer vlan 200

# Combine multiple criteria across lines (implicit or between lines)
ip 192.168.1.10
net 172.16.0.0/12
vlan 300-305