How to specifying a BPF when using af-packet and running as a service (on ubuntu)

Help
1

Hi,

We are running Suricata as a service and using af-packet mode. We would also like to specify a BPF.

I know that I can do it with by launching Suricata manually and putting the BPF on the command line.

I see that there is a known issue that the bpf-filter cannot be set in the suricata.yaml file (BPF filter file with af_packet not functioning)

I don’t see an obvious way to set this in the /etc/default/suricata file

Is there a way to specify the BPF filter when launching as a service? I can always make a new service with the correct command line, but it does not seem to be so nice.

Thanks,

Is there a way to get the desired effect while using a service ?

Thanks

2

Do you mean something like this: https://suricata.readthedocs.io/en/suricata-6.0.0/capture-hardware/ebpf-xdp.html#setup-ebpf-bypass

  - interface: eth3
      threads: 16
      cluster-id: 97
      cluster-type: cluster_qm # symmetric RSS hashing is mandatory to use this mode
      # eBPF file containing a 'filter' function that will be inserted into the
      # kernel and used as packet filter function
      ebpf-filter-file:  /usr/libexec/suricata/ebpf/bypass_filter.bpf
      bypass: yes
      use-mmap: yes
      ring-size: 200000
3

We’ll give it a try … thanks

4

It is also solve with bpf-filter: “…” (I had originannly forgotten the ")