Filter/Rules for appliance capturing on multiple interfaces

[AdamRasnick]

Hey all, I am working with a customer who have a fairly large deployment and we are setting up filters for multiple interfaces on the device...but I am beginning to think its not possible.

For example, we started off just applying a BPF filter...but that filter will only apply to the current interface being captured.  We dont want to use the filter on all interfaces.  Then we looked at Network and APP rules...but if we go that way, is it possible to specify the interface (em1, eth0...)? 

[RSAAdmin · Accepted solution]

Hi Adam, long time no talk.

You can only capture on a single interface or all interfaces, and there is no mechanism within NW/SA for including the  interface in your filter if you're capturing on all interfaces.  If that's a strong requirement, you probably need to look at doing the filtering before the traffic gets to NW... i.e. if there's an aggregation device feeding into the decoder.

[huanzhou1]

for filter on the different interfaces, better do at tap level or mirror port level.

in SA, BPF applies to the interface you selected, no separated BPF for different interfaces. Please node BPF these is length limitation, we had case with support already few weeks but no one knows what's the supported lenght.

To decide what you need to filter, you can collect all the traffic, then run some reports to determine.

[AdamRasnick]

Hey Doug! Long time no talk to! 

Yeah thats kind of what I had discovered.  Havent ever needed to capture on multiple, just something a customer had brought up and thought id throw it out to the rest of the www for input.  We modified a BPF and think we can go with just the one rule we have to get what he wants.  But at least i have more than myself that agrees Hope all is well!!