Suricata - Filter out specific vlan

Hello. I try to filter out specific traffic. More precisely a vlan .
I use AF-packet (IDS mode/TAP) with 2 processing threads on the capturing interface.
I added the bpf-filter: not vlan 571 and it doesn’t work (says in suricata.log Using BPF … on iface ens224) . (when I use for example IP filter it works just fine)
What am I doing wrong?

Thanks in advance.

OS: AlmaLinux 9.3
Kernel: 5.14.0-362.24.1.el9_3.x86_64
Suricata version 6.0.16

Can you share the full configuration and a pcap please?

I am sending you the Suricata configuration file. Sorry, I cannot provide you with a PCAP cause it contains sensitive data.
I only can give some screenshots, if this helps you. I have 2 Vlans, Suricata sees them and identifies them in the logs. You will in the section of the af-packet that I have defined a BPF Filter to block a specific VLAN and a specific IP. The problem is that even if I put the VLAN BPF Filter, it is not working.

image

image

suricata.yaml (76.8 KB)

How do you determine that your filter does not work? Are you still seeing EVE-JSON metadata or alerts for the combination of VLAN and IP that you are trying to filter?

Can you maybe temporarily remove the IP part of the filter and see if that changes anything?

How are you running Suricata? Can you provide the full command line of the suricata process as it is being run, e.g. via systemctl or equivalent?

Are there any other error messages or warnings in your log?

Have you disabled vlan offloading on your NIC (cf networking - Detect VLAN tagged packets using XDP eBPF - Stack Overflow)?

There might also be some magic with the syntax involved (cf the BPF filter dit not work with vlan packets - Stack Overflow)