[Bro] broctl and filtering

James Lay jlay at slave-tothe-box.net
Fri Sep 20 14:23:29 PDT 2013


On 2013-09-20 15:19, Justin Azoff wrote:
> On Fri, Sep 20, 2013 at 07:13:42AM -0600, James Lay wrote:
>> Hey all…trying to pass this:
>>
>> broargs = --filter not ip6
>> Any hints on how to pass the filter the right way?  Thanks all.
>
> in your local.bro, something like this:
>
>     redef PacketFilter::all_packets = F; # don't capture all packets
>     redef capture_filters = [[ "all"] = "not ip6"];

Thanks Justin...I had not thought of that.

James



More information about the Bro mailing list