# Bro restrict filters question

**URL:** <https://community.zeek.org/t/bro-restrict-filters-question/4898>\
**Category:** Zeek\
**Created:** [June 13, 2017, 2:59pm UTC](https://community.zeek.org/t/bro-restrict-filters-question/4898 "2017-06-13T14:59:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Edgmand\_Craig](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@Edgmand\_Craig](https://community.zeek.org/u/Edgmand_Craig)\
**Post date:** [June 13, 2017, 2:59pm UTC](https://community.zeek.org/t/bro-restrict-filters-question/4898/1 "2017-06-13T14:59:18Z")

</div>

Hello,

I am running Bro 2.5 and I am trying to set up some restrict\_filters to drop certain hosts and types of traffic.

I have the following entries in my local.bro…

redef PacketFilter::enable\_auto\_protocol\_capture\_filters = F;  
redef capture\_filters = { [“packets-like-this”] = “ip or not ip” };  
redef restrict\_filters = { [“no-data-like-this”] = “not host 192.168.2.1” };

I had something similar in earlier versions of Bro that seemed to work but this doesn’t work at all.

When I run ./broctl print restrict\_filters it shows that the workers have that filter.

Any ideas?

Thanks,

Craig Edgmand

Oklahoma State University

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [June 13, 2017, 3:12pm UTC](https://community.zeek.org/t/bro-restrict-filters-question/4898/2 "2017-06-13T15:12:41Z")

</div>

Is your traffic vlan tagged? You may need to use

redef restrict\_filters = { ["no-data-like-this"] = "vlan and not host 192.168.2.1" };

---

<div class="post-metadata">

**Author:** ![Edgmand\_Craig](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@Edgmand\_Craig](https://community.zeek.org/u/Edgmand_Craig)\
**Post date:** [June 13, 2017, 7:05pm UTC](https://community.zeek.org/t/bro-restrict-filters-question/4898/3 "2017-06-13T19:05:29Z")

</div>

Oddly enough it works with tcpdump but not with Bro.

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [June 22, 2017, 7:20pm UTC](https://community.zeek.org/t/bro-restrict-filters-question/4898/4 "2017-06-22T19:20:57Z")

</div>

Can you check if "broctl "print PacketFilter::current\_filter" looks  
reasonable, and if the exact filter it returns works for you with tcpdump?

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/bro-restrict-filters-question/4898/5 "2022-05-06T15:45:03Z")

</div>