[Bro] help for adding new packet filter
Vern Paxson
vern at icir.org
Mon Feb 19 10:38:00 PST 2007
> line 1: run-time error: precompile_pcap_filter: pcap_compile((((gre) or (udp)) or (tcp)) or (icmp)): parse error
> can't compile filter (((gre) or (udp)) or (tcp)) or (icmp)
The problem is that tcpdump (at least my version) doesn't have a "gre"
keyword. So, to specify that you want to capture GRE traffic, you'll need
to describe it dirctly in terms of the IP "protocol" field (e.g., "tcp"
is the same as "ip proto 6").
Vern
More information about the Bro
mailing list