BPF filter file with af_packet not functioning

Help
1

Looking for some assistance getting Suricata configuration to function with af_packet and setting a BPF filter file. I am setting bpf-filter: under af_packet in suricata.yaml however getting the error below:

(source-af-packet.c:2274) (AFPSetBPFFilter) – [ERRCODE: SC_ERR_AFP_CREATE(190)] - Failed to compile BPF “”: syntax error

I’ve tested with an inline BPF filter in the configuration and it seems to function.

Is setting the filename not an option in the configuration?

2

Not directly yet in the yaml config in af-packet Feature #3439: bpf-filter does not accept path/file - Suricata - Open Information Security Foundation
But you can specify it on the command line

suricata -F bp.filter

3

Understood and thanks for providing the ticket. I wasn’t able to deduce if this was being worked on or targeted for a release.

4

If you’re willing and able to test, see https://github.com/OISF/suricata/pull/4834