1 EVE Pro Network Filter - BPF 过滤表达式完整参考
文档版本: v1.0
创建时间: 2026-06-15
适用版本: EVE-NG Pro 6.4+ / 7.0+
1.1 一、预设协议列表（18 种）
| 类型 |
协议 |
EVE Pro BPF 表达式 |
IPv4/IPv6 |
子类型 |
| L2 控制平面 |
STP/BPDU |
ether dst 01:80:c2:00:00:00 or ether dst 01:00:0c:cc:cc:cd |
❌ L2 |
✅ Config/TCN/RSTP |
|
CDP |
ether dst 01:00:0c:cc:cc:cc and ether[20:2] = 0x2000 |
❌ L2 |
❌ |
|
LLDP |
ether proto 0x88cc |
❌ L2 |
❌ |
|
IS-IS |
isis |
❌ L2 |
✅ Hello/LSP/CSNP/PSNP |
|
802.1Q |
vlan |
❌ L2 |
❌ |
| IGP |
OSPF |
ip proto 89 |
✅ v4 + v6 |
✅ Hello/DBD/LSR/LSU/LSAck |
|
EIGRP |
ip proto 88 |
✅ v4 + v6 |
✅ Update/Query/Reply/Hello |
|
RIP |
udp port 520 |
✅ v4 + v6 |
✅ Request/Response |
| ICMP |
ICMP |
icmp |
✅ v4 + v6 |
✅ Echo/Dest Unreach/TTL-Exceeded |
|
Ping |
icmp[0] = 8 or icmp[0] = 0 |
✅ v4 + v6 |
✅ Echo Request/Reply |
| EGP |
BGP |
tcp port 179 |
✅ v4 + v6 |
✅ OPEN/UPDATE/NOTIFICATION/KEEPALIVE |
| Overlay |
VXLAN |
udp port 4789 |
✅ v4 + v6 |
✅ VNI 匹配 |
|
LISP |
udp port 4341 or udp port 4342 |
✅ v4 + v6 |
✅ Map-Req/Reply/Register |
| 隧道 |
GRE |
ip proto 47 |
✅ v4 + v6 |
❌ |
| 安全 |
IPsec |
ip proto 50 or ip proto 51 or (udp and (port 500 or port 4500)) |
✅ v4 + v6 |
✅ ESP/AH/ISAKMP |
| AAA |
RADIUS |
udp and (port 1812 or port 1813 or port 1645 or port 1646) |
✅ v4 + v6 |
✅ Auth/Acct |
|
TACACS+ |
tcp port 49 |
✅ v4 + v6 |
❌ |
| 自定义 |
Custom |
用户自定义 BPF |
✅ |
❌ |
1.2 二、BPF 过滤表达式详解
1.2.1 2.1 L2 控制平面协议
1.2.1.1 STP / BPDU
# IEEE 802.1D STP + Cisco PVST+/RSTP
ether dst 01:80:c2:00:00:00 or ether dst 01:00:0c:cc:cc:cd
子类型:
| 子类型 |
BPF 表达式 |
| Config (0x00) |
(ether dst 01:80:c2:00:00:00 and ether[20]=0x00) or (ether dst 01:00:0c:cc:cc:cd and ether[25]=0x00) or (vlan and ether dst 01:00:0c:cc:cc:cd and ether[29]=0x00) |
| TCN (0x80) |
(ether dst 01:80:c2:00:00:00 and ether[20]=0x80) or (ether dst 01:00:0c:cc:cc:cd and ether[25]=0x80) or (vlan and ether dst 01:00:0c:cc:cc:cd and ether[29]=0x80) |
| RSTP (0x02) |
(ether dst 01:80:c2:00:00:00 and ether[20]=0x02) or (ether dst 01:00:0c:cc:cc:cd and ether[25]=0x02) or (vlan and ether dst 01:00:0c:cc:cc:cd and ether[29]=0x02) |
1.2.1.2 CDP (Cisco Discovery Protocol)
ether dst 01:00:0c:cc:cc:cc and ether[20:2] = 0x2000
1.2.1.3 LLDP (Link Layer Discovery Protocol)
ether proto 0x88cc
1.2.1.4 IS-IS
isis
子类型:
| 子类型 |
PDU 类型 |
BPF 表达式 |
| Hello |
15/16/17 |
isis and ((ether[21] & 0x1f) = 15 or (ether[21] & 0x1f) = 16 or (ether[21] & 0x1f) = 17) |
| LSP |
18/20 |
isis and ((ether[21] & 0x1f) = 18 or (ether[21] & 0x1f) = 20) |
| CSNP |
24/25 |
isis and ((ether[21] & 0x1f) = 24 or (ether[21] & 0x1f) = 25) |
| PSNP |
26/27 |
isis and ((ether[21] & 0x1f) = 26 or (ether[21] & 0x1f) = 27) |
1.2.1.5 802.1Q (VLAN)
vlan
1.2.2 2.2 IGP 协议
1.2.2.1 OSPF
# IPv4
ip proto 89
# IPv6
ip6 proto 89
子类型:
| 子类型 |
类型字节 |
IPv4 BPF |
IPv6 BPF |
| Hello |
1 |
ip proto 89 and ip[((ip[0]&0xf)<<2)+1]=1 |
ip6 proto 89 and ip6[41]=1 |
| DBD |
2 |
ip proto 89 and ip[((ip[0]&0xf)<<2)+1]=2 |
ip6 proto 89 and ip6[41]=2 |
| LSR |
3 |
ip proto 89 and ip[((ip[0]&0xf)<<2)+1]=3 |
ip6 proto 89 and ip6[41]=3 |
| LSU |
4 |
ip proto 89 and ip[((ip[0]&0xf)<<2)+1]=4 |
ip6 proto 89 and ip6[41]=4 |
| LSAck |
5 |
ip proto 89 and ip[((ip[0]&0xf)<<2)+1]=5 |
ip6 proto 89 and ip6[41]=5 |
偏移量计算:
ip[0]&0xf = IHL（IP 头长度，低 4 位，单位 4 字节）((ip[0]&0xf)<<2) = IP 头长度（字节）+1 = OSPF 类型字段偏移
1.2.2.2 EIGRP
# IPv4
ip proto 88
# IPv6
ip6 proto 88
子类型 (⚠️ 仅 IPv4):
| 子类型 |
OpCode |
BPF 表达式 |
| Update |
1 |
ip proto 88 and ip[((ip[0]&0xf)<<2)+1]=1 |
| Query |
3 |
ip proto 88 and ip[((ip[0]&0xf)<<2)+1]=3 |
| Reply |
4 |
ip proto 88 and ip[((ip[0]&0xf)<<2)+1]=4 |
| Hello/Ack |
5 |
ip proto 88 and ip[((ip[0]&0xf)<<2)+1]=5 |
| SIA-Query |
10 |
ip proto 88 and ip[((ip[0]&0xf)<<2)+1]=10 |
| SIA-Reply |
11 |
ip proto 88 and ip[((ip[0]&0xf)<<2)+1]=11 |
1.2.2.3 RIP
# IPv4
udp port 520
# IPv6 (RIPng)
udp port 521
子类型 (⚠️ 仅 IPv4):
| 子类型 |
Command |
BPF 表达式 |
| Request |
1 |
udp port 520 and udp[8]=1 |
| Response |
2 |
udp port 520 and udp[8]=2 |
1.2.3 2.3 ICMP 协议
1.2.3.1 ICMP
# IPv4
icmp
# IPv6
icmp6
子类型:
| 子类型 |
IPv4 Type |
IPv6 Type |
IPv4 BPF |
IPv6 BPF |
| Echo Request |
8 |
128 |
icmp[icmptype]=8 |
icmp6 and ip6[40]=128 |
| Echo Reply |
0 |
129 |
icmp[icmptype]=0 |
icmp6 and ip6[40]=129 |
| Dest Unreachable |
3 |
1 |
icmp[icmptype]=3 |
icmp6 and ip6[40]=1 |
| TTL Exceeded |
11 |
3 |
icmp[icmptype]=11 |
icmp6 and ip6[40]=3 |
| Redirect |
5 |
- |
icmp[icmptype]=5 |
❌ |
1.2.3.2 Ping (Echo)
# IPv4
icmp[0] = 8 or icmp[0] = 0
# IPv6
icmp6 and (ip6[40] = 128 or ip6[40] = 129)
1.2.4 2.4 EGP 协议
1.2.4.1 BGP
tcp port 179
子类型 (⚠️ 仅 IPv4):
| 子类型 |
消息类型 |
BPF 表达式 |
| OPEN |
1 |
tcp port 179 and tcp[((tcp[12]&0xf0)>>2)+18]=1 |
| UPDATE |
2 |
tcp port 179 and tcp[((tcp[12]&0xf0)>>2)+18]=2 |
| NOTIFICATION |
3 |
tcp port 179 and tcp[((tcp[12]&0xf0)>>2)+18]=3 |
| KEEPALIVE |
4 |
tcp port 179 and tcp[((tcp[12]&0xf0)>>2)+18]=4 |
偏移量计算:
tcp[12]&0xf0 = TCP 数据偏移（高 4 位，单位 4 字节）((tcp[12]&0xf0)>>2) = TCP 头长度（字节）+18 = BGP 消息头的 Type 字段偏移
1.2.5 2.5 Overlay 协议
1.2.5.1 VXLAN
# 基础匹配
udp port 4789
VNI 匹配:
| 写法 |
表达式 |
说明 |
| 3 字节比对(Pro 7.8+) |
ether[46:3] == 0xVVVVVV |
简洁，EVE-NG Pro 78 支持 |
| 2+1 字节拆分(通用) |
ether[46:2] == 0xXXXX and ether[48] == 0xXX |
兼容性最好 |
VNI 速查:
| VNI |
十六进制 |
3 字节写法 |
2+1 字节写法 |
| 10000 |
0x002710 |
ether[46:3] == 0x002710 |
ether[46:2] == 0x0027 and ether[48] == 0x10 |
| 20000 |
0x004E20 |
ether[46:3] == 0x004E20 |
ether[46:2] == 0x004E and ether[48] == 0x20 |
| 5001 |
0x001389 |
ether[46:3] == 0x001389 |
ether[46:2] == 0x0013 and ether[48] == 0x89 |
| 90000 |
0x015F90 |
ether[46:3] == 0x015F90 |
ether[46:2] == 0x015F and ether[48] == 0x90 |
| 91000 |
0x016378 |
ether[46:3] == 0x016378 |
ether[46:2] == 0x0163 and ether[48] == 0x78 |
完整示例 (VXLAN + VLAN + 源网络):
# VXLAN VNI 90000，Tenant-A 网络 172.16.0.0/16
(src net 172.16.0.0/16 and icmp) or
(udp port 4789 and ether[46:3] == 0x015F90 and ether[73] == 1) or
(vlan and src net 172.16.0.0/16 and icmp)
1.2.5.2 LISP
udp port 4341 or udp port 4342
子类型 (⚠️ 仅 IPv4):
| 子类型 |
消息类型 |
BPF 表达式 |
| Map-Request |
0x10 |
udp dst port 4342 and (udp[8]&0xf0)=0x10 |
| Map-Reply |
0x20 |
udp dst port 4342 and (udp[8]&0xf0)=0x20 |
| Map-Register |
0x30 |
udp dst port 4342 and (udp[8]&0xf0)=0x30 |
| Map-Notify |
0x40 |
udp dst port 4342 and (udp[8]&0xf0)=0x40 |
1.2.6 2.6 隧道协议
1.2.6.1 GRE
# IPv4
ip proto 47
# IPv6
ip6 proto 47
1.2.7 2.7 安全协议
1.2.7.1 IPsec
# IPv4
ip proto 50 or ip proto 51 or (ip and udp and (port 500 or port 4500))
# IPv6
ip6 proto 50 or ip6 proto 51 or (ip6 and udp and (port 500 or port 4500))
子类型:
| 子类型 |
协议 |
IPv4 BPF |
IPv6 BPF |
| ESP |
50 |
ip proto 50 |
ip6 proto 50 |
| AH |
51 |
ip proto 51 |
ip6 proto 51 |
| ISAKMP/IKE |
UDP 500/4500 |
udp and (port 500 or port 4500) |
ip6 and udp and (port 500 or port 4500) |
1.2.7.2 RADIUS
udp and (port 1812 or port 1813 or port 1645 or port 1646)
子类型:
| 子类型 |
端口 |
BPF 表达式 |
| Auth |
1812/1645 |
udp and (port 1812 or port 1645) |
| Acct |
1813/1646 |
udp and (port 1813 or port 1646) |
1.2.7.3 TACACS+
tcp port 49
1.3 三、BPF 表达式构建指南
1.3.1 3.1 核心构建模板
(核心表达式) and (可选条件1) and (可选条件2) ...
可选条件:
src host <IP> - 源 IPdst host <IP> - 目的 IPsrc net <CIDR> - 源网段dst net <CIDR> - 目的网段port <N> - 端口tcp / udp / icmp - L4 协议
1.3.2 3.2 VLAN 支持（必须手动添加）
如果协议可能通过 VLAN 传输，需要手动添加 VLAN 分支：
# 基础（无 VLAN）
udp port 4789 and ether[46:3] == 0x015F90
# 完整（支持 VLAN）
(udp port 4789 and ether[46:3] == 0x015F90) or (vlan and udp port 4789 and ether[46:3] == 0x015F90)
1.3.3 3.3 OR 表达式中 vlan 必须放最后
# ✅ 正确：vlan 放最后
icmp[0] == 8 or (udp port 4789 and ether[84] == 8) or (vlan and icmp[0] == 8)
# ❌ 错误：vlan 在中间
icmp[0] == 8 or (vlan and icmp[0] == 8) or (udp port 4789 and ether[84] == 8)
原因: vlan 关键字会永久改变 BPF 偏移寄存器，导致后续分支基于错误基准点计算。
1.4 四、实战示例
1.4.1 4.1 示例 1：OSPF Hello（IPv4，源 IP 10.0.0.1）
(ip proto 89 and ip[((ip[0]&0xf)<<2)+1]=1) and src host 10.0.0.1
1.4.2 4.2 示例 2：BGP UPDATE 消息（IPv4）
tcp port 179 and tcp[((tcp[12]&0xf0)>>2)+18]=2
1.4.3 4.3 示例 3：VXLAN VNI 5001
# 基础（无 VLAN）
udp port 4789 and ether[46:3] == 0x001389
# 完整（支持 VLAN）
(udp port 4789 and ether[46:3] == 0x001389) or (vlan and udp port 4789 and ether[46:3] == 0x001389)
1.4.4 4.4 示例 4：Tenant-A ICMP 流量（VXLAN+VLAN+裸包）
# Tenant-A: VNI 90000, 网络 172.16.0.0/16
(src net 172.16.0.0/16 and icmp) or
(udp port 4789 and ether[46:3] == 0x015F90 and ether[73] == 1) or
(vlan and src net 172.16.0.0/16 and icmp)
1.4.5 4.5 示例 5：RADIUS Auth + Acct
udp and (port 1812 or port 1813 or port 1645 or port 1646)
1.5 五、缺失协议补充
以下协议不在预设列表中，可使用自定义 BPF：
| 协议 |
用途 |
BPF 表达式 |
| ARP |
地址解析 |
arp或 ether proto 0x0806 |
| NDP |
IPv6 地址解析 |
icmp6 and (ip6[40]=135 or ip6[40]=136) |
| LDP |
MPLS 标签分发 |
udp port 646 |
| RSVP |
MPLS TE |
ip proto 46 |
| BFD |
双向转发检测 |
udp port 3784 or udp port 3785 |
| VRRP |
虚拟路由器冗余 |
ip proto 112 |
| HSRP |
Cisco 热备 |
udp port 1985 |
1.6 六、BPF 语法速查
1.6.1 6.1 基本语法
| 语法 |
说明 |
示例 |
host <IP> |
源或目的 IP |
host 10.0.0.1 |
src host <IP> |
源 IP |
src host 10.0.0.1 |
dst host <IP> |
目的 IP |
dst host 10.0.0.2 |
net <CIDR> |
网段 |
net 172.16.0.0/16 |
port <N> |
端口 |
port 179 |
proto <N> |
IP 协议号 |
proto 89(OSPF) |
vlan |
802.1Q 标记 |
vlan and ip |
and/or/not |
逻辑运算符 |
ip and tcp and not port 22 |
1.6.2 6.2 字节匹配
| 语法 |
说明 |
示例 |
ip[n] |
IPv4 头第 n 字节 |
ip[0]= Version + IHL |
ip6[n] |
IPv6 头第 n 字节 |
ip6[40]= Next Header 后第一个字节 |
tcp[n] |
TCP 头第 n 字节 |
tcp[12]= Data Offset + Flags |
udp[n] |
UDP 头第 n 字节 |
udp[8]= LISP Type |
ether[n] |
Ethernet 头第 n 字节 |
ether[46]= VXLAN VNI 高字节 |
ip[n:m] |
从 n 开始取 m 字节 |
ip[20:4]= Source Address |
udp[n:m] |
从 n 开始取 m 字节 |
udp[12:4]= VXLAN 头 |
1.6.3 6.3 位运算
| 语法 |
说明 |
示例 |
& |
按位与 |
ip[0]&0xf= IHL |
<< |
左移 |
(ip[0]&0xf)<<2= IP 头长度（字节） |
>> |
右移 |
(udp[12:4]>>8)= VNI 高 24 位 |
1.7 七、BPF 黄金法则
1.7.1 法则 1️⃣：VNI 必须拆分
# ❌ 错误：3 字节比对
ether[46:3] == 0x002710
# ✅ 正确：拆分为 2+1 字节
ether[46:2] == 0x0027 and ether[48] == 0x10
1.7.2 法则 2️⃣：OR 中 vlan 必须放最后
# ✅ 正确
icmp[0] == 8 or (udp ...) or (vlan and icmp[0] == 8)
# ❌ 错误
vlan and icmp[0] == 8 or icmp[0] == 8 or (udp ...)
1.7.3 法则 3️⃣：括号具有作用域隔离
# ✅ 递归嵌套：vlan 指针各自独立
arp or (vlan and (arp or (vlan and arp)))
# ❌ 平铺展开：多 vlan 并列导致偏移混乱
arp or (vlan and arp) or (vlan and vlan and arp)
文档状态: ✅ 完成
