[Bro] Exclude IPS - only src ip
hckim at narusec.com
Mon Dec 15 17:55:07 PST 2014
src_ip I want to filter out is a 'proxy web server ip'. I want to watch
only local net work log.
There is to much proxy_src_ip log that we do not need, other reason is to
reduce log amount
(I am getting live traffic by mirror which our customer is doing, so I do
not have any choice)
I did not write multiple “redef restrict_filters” line. I ran one line at
On Tue, Dec 16, 2014 at 12:09 AM, Seth Hall <seth at icir.org> wrote:
> > On Dec 15, 2014, at 6:08 AM, 김희철 <hckim at narusec.com> wrote:
> > it there a way to filter out only a src_ip?
> Are you sure you really want to filter a src address? Because Bro
> typically needs full duplex traffic to work correctly, it rarely makes
> sense to filter with a src or dst.
> Do you also have multiple “redef restrict_filters” line as you showed?
> You are doing full value assignment by using “=“ instead of extending the
> table with “+=“ which will definitely cause you trouble if that’s happening.
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro