[Bro] Exclude IPS - only src ip

[김희철]

src_ip I want to filter out is a 'proxy web server ip'. I want to watch
only local net work log.
There is to much proxy_src_ip log that we do not need, other reason is to
reduce log amount
(I am getting live traffic by mirror which our customer is doing, so I do
not have any choice)


I did not write multiple  “redef restrict_filters” line. I ran one line at
a time.

Thank you


On Tue, Dec 16, 2014 at 12:09 AM, Seth Hall <seth at icir.org> wrote:
>
>
> > On Dec 15, 2014, at 6:08 AM, 김희철 <hckim at narusec.com> wrote:
> >
> > it there a way to filter out only a src_ip?
>
> Are you sure you really want to filter a src address?  Because Bro
> typically needs full duplex traffic to work correctly, it rarely makes
> sense to filter with a src or dst.
>
> Do you also have multiple “redef restrict_filters” line as you showed?
> You are doing full value assignment by using “=“ instead of extending the
> table with “+=“ which will definitely cause you trouble if that’s happening.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20141216/48b74eaf/attachment.html