Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug/Support Request] - Combined Filters - Conflicting Logic #6

Open
zoomequipd opened this issue Apr 9, 2022 · 0 comments
Open

[Bug/Support Request] - Combined Filters - Conflicting Logic #6

zoomequipd opened this issue Apr 9, 2022 · 0 comments

Comments

@zoomequipd
Copy link

Desired Output:
I ran into an issue while trying to negating traffic from an ASN while including specific subnet which fall into a negated ASN.
The pcap as lots of traffic for ASN 8075. However, 13.69.0.0/17, which is in ASN8075, falls into the AzureCloud.westeurope and I'd like to include that specific range (along with several more thousand)

I attempted to use this test, which i'm hoping will be anything to/from 10.0.0.0/8, 13.69.0.0/17, excluding anything else in 8075.

all_including_public_cloud_microsoft:
  conditions:
  - kind: subnet
    negate: false
    match:
    - 10.0.0.0/8
    - 13.69.0.0/17
  - kind: asn
    negate: true
    match:
    - 8075

However in practice, this appeared to filter out all traffic from 8075, including 13.69.0.0/17.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant