[Bro] Filtering based on port-number

Seth Hall seth at icir.org
Thu Oct 7 12:48:12 PDT 2010

On Oct 7, 2010, at 3:41 PM, Peter Erickson wrote:

> when loading dpd you may need to change the filter to include all
> packets, e.g. on the command line:
> bro -f "tcp or udp or icmp" ...

You can also change the filter at the script level list this..
    redef capture_filters += { ["all-ip-traffic"] = "ip" };


More information about the Bro mailing list