# Bro 0.8 and vlans

**URL:** <https://community.zeek.org/t/bro-0-8-and-vlans/343>\
**Category:** Zeek\
**Created:** [February 7, 2003, 6:02am UTC](https://community.zeek.org/t/bro-0-8-and-vlans/343 "2003-02-07T06:02:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [February 7, 2003, 6:02am UTC](https://community.zeek.org/t/bro-0-8-and-vlans/343/1 "2003-02-07T06:02:19Z")

</div>

> &nbsp;&nbsp;&nbsp;in my policy file: redef restrict\_filter = "vlan";

Oops. Unfortunately, "vlan" is a hack bolted onto tcpdump/libpcap.  
I discussed bugs in it that Bro tickled with Bill Fenner a while ago.  
Here's the tail end of that thread, which included a patch that worked for  
one of your NCSA colleagues.

> &nbsp;&nbsp;&nbsp;no problem. tcpdump works fine with the above expression.. seems to work 🙂
> 
> &nbsp;&nbsp;&nbsp;so now, in bro, I use the redef capture\_filter = \<above expression\>

There were also some related problems with Bro reading from multiple  
interfaces, because the vlan keyword diddles the hdr\_size in a non-reentrant  
way (or at least it used to), but I don't know if that's what's tripping  
you up or not.

Does Bro work okay for you w/o the "vlan"?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/bro-0-8-and-vlans/343/2 "2022-05-06T15:36:42Z")

</div>