[Bro] broctl and filtering
jlay at slave-tothe-box.net
Fri Sep 20 14:23:29 PDT 2013
On 2013-09-20 15:19, Justin Azoff wrote:
> On Fri, Sep 20, 2013 at 07:13:42AM -0600, James Lay wrote:
>> Hey all…trying to pass this:
>> broargs = --filter not ip6
>> Any hints on how to pass the filter the right way? Thanks all.
> in your local.bro, something like this:
> redef PacketFilter::all_packets = F; # don't capture all packets
> redef capture_filters = [[ "all"] = "not ip6"];
Thanks Justin...I had not thought of that.
More information about the Bro