Looking for some assistance getting Suricata configuration to function with af_packet and setting a BPF filter file. I am setting bpf-filter: under af_packet in suricata.yaml however getting the error below:
(source-af-packet.c:2274) (AFPSetBPFFilter) – [ERRCODE: SC_ERR_AFP_CREATE(190)] - Failed to compile BPF “”: syntax error
I’ve tested with an inline BPF filter in the configuration and it seems to function.
Is setting the filename not an option in the configuration?