# bro-simple-scan exclude IP addresses

**URL:** <https://community.zeek.org/t/bro-simple-scan-exclude-ip-addresses/6011>\
**Category:** Zeek\
**Created:** [February 14, 2020, 7:54pm UTC](https://community.zeek.org/t/bro-simple-scan-exclude-ip-addresses/6011 "2020-02-14T19:54:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gordon\_Wallum](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@Gordon\_Wallum](https://community.zeek.org/u/Gordon_Wallum)\
**Post date:** [February 14, 2020, 7:54pm UTC](https://community.zeek.org/t/bro-simple-scan-exclude-ip-addresses/6011/1 "2020-02-14T19:54:37Z")

</div>

I’m new to Zeek and looking for help with bro-simple-scan to exclude Ip addresses. I am trying to use runtime options and if breaks to the script to accomplish this.

After running i get an error for my options variables. I don’t know if I should move my excludes to a different part of the script or if my options are just not working right.

Any help would be greatly appreciated

**Error**  
error in /opt/bro/share/zeek/policy/custom-scripts/./bro-simple-scan2, line 276: unknown identifier exvictim\_ips, at or near “exvictim\_ips”

**My config steps:**

Edit local.bro to include the config file:  
redef Config::config\_files += { “/path/to/config.dat” };

**Create config file with variables:**

PortScanning::exvictim\_ips  
PortScanning::exscanner\_ips xxx.xxx.xxx.xxx,yyy.yyy.yyy.yyy  
PortScanning::exscanned\_ports

Edit the bro-simple-scan script:

**Added module and export variable options (after @loads)**  
module PortScanning;  
export {  
option exvictim\_ips: set[addr] = {};  
option exscanner\_ips: set[addr] = {};  
option exscanned\_ports: set[port] = {};  
}

**Added if break (in the cluster hook Scan::scan\_policy)**

if ( hook Scan::scan\_policy(scanner, victim, scanned\_port) )

{  
if (( victim in exvictim\_ips) || ( scanner in exscanner\_ips ) || ( scanned\_port in exscanned\_ports))  
break;

**Add an if break (in the standalone hook Scan::scan\_policy)**

if ( hook Scan::scan\_policy(scanner, victim, scanned\_port) )  
{  
if (( victim in exvictim\_ips) || ( scanner in exscanner\_ips ) || ( scanned\_port in exscanned\_ports))  
break;

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [February 18, 2020, 6:43pm UTC](https://community.zeek.org/t/bro-simple-scan-exclude-ip-addresses/6011/2 "2020-02-18T18:43:59Z")

</div>

Ah… a bit of confusion here… but nothing too hard to fix. So what Michał showed here: [https://gist.github.com/mpurzynski/96a26c42874898447554531b6df9a4bb](https://gist.github.com/mpurzynski/96a26c42874898447554531b6df9a4bb) was almost exactly what you needed.

Undo any changes you made to the scripts (or just reinstall them i guess). The scan policy hook itself is already there for this exact purpose, so you don’t need to change anything.

Just make a new file called scan-policy.zeek that contains

redef Config::config\_files += { “/path/to/config.dat” };

module PortScanning;  
export {  
option exvictim\_ips: set[addr] = {};  
option exscanner\_ips: set[addr] = {};  
option exscanned\_ports: set[port] = {};  
}

hook Scan::scan\_policy(scanner: addr, victim: addr, scanned\_port: port)  
{  
if (( victim in exvictim\_ips) || ( scanner in exscanner\_ips ) || ( scanned\_port in exscanned\_ports))  
break;  
}

done! that’s all you need.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/bro-simple-scan-exclude-ip-addresses/6011/3 "2022-05-06T15:47:04Z")

</div>