Questions about ENV_PCAP_FILTER

[alleniverson33]

Hi，
in k8s
How to ignore the internal traffic of Malcolm when using netsniff-ng to capture traffic

[mmguero]

In Malcolm's environment variables there's a PCAP_FILTER variable.

This filter will be used to limit what traffic the PCAP service (netsniff-ng or tcpdump) and the traffic analysis services (zeek and suricata) will see. Capture filters are specified using Berkeley Packet Filter (BPF) syntax. For example, to ignore the ports Hedgehog Linux uses to communicate with Malcolm, users could specify not port 5044 and not port 5045 and not port 8005 and not port 8006 and not port 9200.

So it really just depends on what traffic you want to filter out. Identify the traffic you don't want to generate PCAP for, and create a filter in PCAP_FILTER to exclude it. Normally you'd not be capturing on the same interface Malcolm is using for management.