# Bro vlan tagging

**URL:** <https://community.zeek.org/t/bro-vlan-tagging/865>\
**Category:** Zeek\
**Created:** [September 19, 2005, 10:25pm UTC](https://community.zeek.org/t/bro-vlan-tagging/865 "2005-09-19T22:25:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joncarlo\_Ruggieri1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Joncarlo\_Ruggieri1](https://community.zeek.org/u/Joncarlo_Ruggieri1)\
**Post date:** [September 19, 2005, 10:25pm UTC](https://community.zeek.org/t/bro-vlan-tagging/865/1 "2005-09-19T22:25:23Z")

</div>

Hi,

Thanks for the quick replies!

Within vlan.bro, will I need to define the vlans and their tags?

I see:

redef restrict\_filters += { ["vlan"] = "vlan" };

Do I list a vlan name within the ["vlan"] and some tag information within  
the other "vlan"? Is the second part an actual tag or subnet/mask data?

Thanks again!

Jon Ruggieri

---

<div class="post-metadata">

**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\
**Post date:** [September 19, 2005, 11:18pm UTC](https://community.zeek.org/t/bro-vlan-tagging/865/2 "2005-09-19T23:18:07Z")

</div>

Have a look at pcap.bro, where restrict\_filters is defined. The former  
"vlan" is just a textual identifier, the second is the actual addition  
to the pcap filtering expression that will narrow the filtering down  
further -- it effectively comes down to filtering "vlan and (remaining  
filter)".

What Adam and Scott meant was to just @load vlan.bro into your  
configuration, not change anything inside vlan.bro.

If you need to filter on a specific tag, I believe pcap.bro will need  
some tweaking. Let us know if that's the case (or everyone please do  
correct me if I'm wrong).

Cheers,  
Christian.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-vlan-tagging/865/3 "2022-05-06T15:37:41Z")

</div>