I have a rather large bpf at the end of my suricata.service file…ip’s that I do not want to have rules fire on or monitor. Today I had to add two more, but these did not appear to function as alerts still came through (yes I daemon-reloaded). I even started via command line in a shell and I still saw hits. Is there a max that’ I’ve reached? I just added them to HOME_NET for now and that appears to be working.
Hi, I don’t see any immediate clues why BPF filter should be limited in length. Can you tell us how many IPs you have and what’s the character length of your total BPF filter? Thanks
Also, if you can try to apply your BPF filter to e.g. tcpdump and see if it works that could be also helpful. If the BPF filter would be too long, I would expect to be rejected at the Suricata/BPF initialization.