 Filtering IDS Packets
The simplest and most efficient way to extract needed data from the ever-growing database logging these packets is to use a combination of Berkeley packet filters (bpf) and bitmask filters.
Manual Reference Pages - BPF
Includes a BPF synopsis, overview, header and filter information, along with examples, files, and bugs.
The BSD Packet Filter (PDF)
The BSD Packet Filter (BPF) uses a new, register based filter evaluator that is up to 20 times faster than the original design. BPF also uses a straightforward buffering strategy that makes its overall performance up to 100 times faster than Sun’s NIT running on the same hardware.
|
|
