gophercap
gophercap copied to clipboard
[Bug/Support Request] - Combined Filters - Conflicting Logic
Desired Output: I ran into an issue while trying to negating traffic from an ASN while including specific subnet which fall into a negated ASN. The pcap as lots of traffic for ASN 8075. However, 13.69.0.0/17, which is in ASN8075, falls into the AzureCloud.westeurope and I'd like to include that specific range (along with several more thousand)
I attempted to use this test, which i'm hoping will be anything to/from 10.0.0.0/8, 13.69.0.0/17, excluding anything else in 8075.
all_including_public_cloud_microsoft:
conditions:
- kind: subnet
negate: false
match:
- 10.0.0.0/8
- 13.69.0.0/17
- kind: asn
negate: true
match:
- 8075
However in practice, this appeared to filter out all traffic from 8075, including 13.69.0.0/17.