Adapting packet filter in stand-alone cluster

Zeek
1

I am getting started with Bro, and am using Robin's 1.4 stand-alone cluster branch. I was trying to detect some IRC traffic using DPD, but realized that it was being filtered. In the Workshop 2009 materials, it mentioned adapting the packet filter by adding the -f "tcp". I tried that, tested it on my pcap file, and it worked. How do I enable/disable the -f "tcp" option in the cluster configuration?

Tyler

2

You can do it from your policy script.

In policy/local/local.bro (assuming you're using everything as it ships)...

redef capture_filters = { ["all-ip-packets"] = "ip or ip6" };

   .Seth