search

StamusNetworks / gophercap

Accurate, modular, scalable PCAP manipulation tool written in Go.
GNU General Public License v3.0
85 stars 12 forks source link

[Bug/Support Request] - Combined Filters - Conflicting Logic #6

Open zoomequipd opened 2 years ago

zoomequipd commented 2 years ago

Desired Output: I ran into an issue while trying to negating traffic from an ASN while including specific subnet which fall into a negated ASN. The pcap as lots of traffic for ASN 8075. However, 13.69.0.0/17, which is in ASN8075, falls into the AzureCloud.westeurope and I'd like to include that specific range (along with several more thousand)

I attempted to use this test, which i'm hoping will be anything to/from 10.0.0.0/8, 13.69.0.0/17, excluding anything else in 8075. 

all_including_public_cloud_microsoft:
  conditions:
  - kind: subnet
    negate: false
    match:
    - 10.0.0.0/8
    - 13.69.0.0/17
  - kind: asn
    negate: true
    match:
    - 8075

However in practice, this appeared to filter out all traffic from 8075, including 13.69.0.0/17.