# Bro as a fancy pcap filter **URL:** \ **Category:** Zeek\ **Created:** [November 22, 2005, 1:48am UTC](https://community.zeek.org/t/bro-as-a-fancy-pcap-filter/899 "2005-11-22T01:48:09Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [November 22, 2005, 1:48am UTC](https://community.zeek.org/t/bro-as-a-fancy-pcap-filter/899/1 "2005-11-22T01:48:09Z")
Hi, I just bumped into a situation where I wanted to tell Bro to record packets to an output pcap file, but do so only under certain circumstances. In my case this essentially boiled down to "only the first packet in a 5-tuple TCP/UDP flow that carries app-layer data", but let's imagine any decision that depends on policy- or in-core state. I got it to work by hacking around in the core, but it wasn't pretty. Does Bro have a mechanism for doing this nicely? In the rewriter framework, maybe (is that documented anywhere btw)? Thanks! Cheers, Christian. ---
**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\ **Post date:** [November 22, 2005, 2:15am UTC](https://community.zeek.org/t/bro-as-a-fancy-pcap-filter/899/2 "2005-11-22T02:15:20Z")
> I just bumped into a situation where I wanted to tell Bro to record > packets to an output pcap file, but do so only under certain > circumstances. In my case this essentially boiled down to "only the > first packet in a 5-tuple TCP/UDP flow that carries app-layer data", but > let's imagine any decision that depends on policy- or in-core state. > > I got it to work by hacking around in the core, but it wasn't pretty. > Does Bro have a mechanism for doing this nicely? In the rewriter > framework, maybe (is that documented anywhere btw)? Thanks! Yes, there's some primitive mechanism to do that. Sorry, it's undocumented, but let me give it a try here: # Set the flag to true to enable "TCP source packet writer" (sorry, no UDP) # All packets will be kept until they are dumping or end of connection. So please be very careful in using it for live traffic. redef dump\_selected\_source\_packets = T; event tcp\_packet(c: connection, ...)          {          if ( \ )                  dump\_packets\_of\_connection(c); # dump all packets up to this point for connection c.          } And you can imagine calling dump\_packets\_of\_connection() in all kinds of other events. Currently there's no built-in function to discard packets that we do not want to dump (so there's no way to dump the exact 10th packet of a connection), but the code is already there (see class TCP\_SourcePacketWriter), so it's fairly simple to implement. Ruoming ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 22, 2005, 3:04am UTC](https://community.zeek.org/t/bro-as-a-fancy-pcap-filter/899/3 "2005-11-22T03:04:46Z")
Alternatively, and more fine-grained, there is global dump\_current\_packet: function(file\_name: string): bool; which can be called at any time and, well, dumps the current packet into the given file. If the file already exists, the packet is appended. If you always dump into the same file, Bro is smart enough to keep it open all the time. Robin ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [November 22, 2005, 4:13am UTC](https://community.zeek.org/t/bro-as-a-fancy-pcap-filter/899/4 "2005-11-22T04:13:04Z")
Nice! That's exactly what I need -- thanks a bunch guys. Cheers, Christian. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-as-a-fancy-pcap-filter/899/5 "2022-05-06T15:37:44Z")