[Bro] Problem changing restrict_filters

sangdrax8 sangdrax8 at gmail.com
Mon Feb 3 09:37:01 PST 2014


I am having an issue with changing my restrict_filters that I setup a while
back.  I don't know if I am just forgetting how this works, but if someone
can help me out here it would be much appreciated.

Previously I had added a section to my local.bro file to restrict the
traffic some of my nodes are seeing.  I used the following syntax with some
dummy IP's for an example:

const idsvm4_hosts = "192.168.0.1 or 192.168.0.2";

redef PacketFilter::enable_auto_protocol_capture_filters = T;
redef capture_filters = { ["all"] = "ip or not ip" };
redef restrict_filters = { ["local-src"] = "src host ("+idsvm4_hosts+")"  };
redef restrict_filters += { ["local-dst"] = "dst host ("+idsvm4_hosts+")"
 };

When I did this, I could use the print command in broctl to see that it was
in fact working as expected. (print restrict_filters idsvm4)

Now I am trying to change this list, and so I have edited the const I
declared previously.  I added a few hosts to idsvm4_hosts, and I did an
install and restart.  When I run the same print, I get back the original
restrict_filters.  It looks like the node keeps the old one.

while troubleshooting this I have gone as far as to completely remove all
my code about packet filters.  I issued an install, and restarted the
entire cluster.  Still the print statement returns with the ORIGINAL
restrict_filters I set a few months ago.  I feel like I must be missing
something here, but I just can't remember what I did.  I know I made this
variable so that in the future I could easily update it, but here I am
trying to update it with no success.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140203/c00ade03/attachment.html 


More information about the Bro mailing list