# broctl and filtering

**URL:** https://community.zeek.org/t/broctl-and-filtering/2819
**Category:** Zeek
**Created:** [September 20, 2013, 1:13pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819 "2013-09-20T13:13:42Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [September 20, 2013, 1:13pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819/1 "2013-09-20T13:13:42Z")

</div>

Hey all…trying to pass this:

broargs = --filter not ip6

a few different ways, but I'm not having much luck:

broargs = --filter not ip6  
broargs = --filter 'not ip6'  
broargs = --filter "not ip6"

==== stderr.log  
error: can't open ip6

or

==== stderr.log  
/usr/local/bro/share/broctl/scripts/broctl-config.sh: line 67: ip6: command not found  
error: can't open ip6

==== .cmdline  
-i eth1 -U .status -p broctl -p broctl-live -p standalone -p local -p bro local.bro broctl broctl/standalone broctl/auto --filter not ip6

Any hints on how to pass the filter the right way? Thanks all.

James

---

<div class="post-metadata">

### Author: ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)
#### Post date: [September 20, 2013, 8:39pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819/2 "2013-09-20T20:39:29Z")

</div>

You need to quote the value of the --filter option like this:

broargs = --filter 'not ip6'

There was a bug that was preventing this from working.  
If you look in \<prefix\>/share/broctl/scripts (\<prefix\>  
is your Bro install prefix), you can patch the following  
scripts:

--- check-config.orig  
+++ check-config  
@@ -25,7 +25,7 @@ export PATH=${bindir}:${scriptsdir}:$PATH  
&nbsp;&nbsp;echo $@ \>.cmdline  
&nbsp;&nbsp;touch .checking

-${bro} $@  
+${bro} "$@"  
&nbsp;&nbsp;rc=$?

&nbsp;&nbsp;if ["$rc" == "0"] && ["$print\_scripts" == "1"]; then  
--- helpers/start.orig  
+++ helpers/start  
@@ -9,7 +9,7 @@ shift

&nbsp;&nbsp;rm -f .pid

-nohup ${scriptsdir}/run-bro $@ \>stdout.log 2\>stderr.log &  
+nohup ${scriptsdir}/run-bro "$@" \>stdout.log 2\>stderr.log &

&nbsp;&nbsp;while [! -s .pid]; do  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sleep 1  
--- run-bro.orig  
+++ run-bro  
@@ -71,9 +71,9 @@ if [-n "${pin\_command}" -a $pin\_cpu -ge 0]; then  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi

- nohup ${pin\_command} $pin\_cpu $mybro $@ &  
+ nohup ${pin\_command} $pin\_cpu $mybro "$@" &  
&nbsp;&nbsp;else  
- nohup $mybro $@ &  
+ nohup $mybro "$@" &  
&nbsp;&nbsp;fi

&nbsp;&nbsp;child=$!  
--- run-bro-on-trace.orig  
+++ run-bro-on-trace  
@@ -20,5 +20,5 @@ cd $cwd  
&nbsp;&nbsp;echo $@ \>.cmdline  
&nbsp;&nbsp;touch .testing

-${bro} -r $trace $@  
+${bro} -r $trace "$@"

---

<div class="post-metadata">

### Author: ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [September 20, 2013, 9:12pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819/3 "2013-09-20T21:12:53Z")

</div>

Wow thanks a TON Daniel....patched up and good to go 🙂

James

---

<div class="post-metadata">

### Author: ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)
#### Post date: [September 20, 2013, 9:19pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819/4 "2013-09-20T21:19:41Z")

</div>

in your local.bro, something like this:

&nbsp;&nbsp;&nbsp;&nbsp;redef PacketFilter::all\_packets = F; # don't capture all packets  
&nbsp;&nbsp;&nbsp;&nbsp;redef capture\_filters = [["all"] = "not ip6"];

---

<div class="post-metadata">

### Author: ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [September 20, 2013, 9:23pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819/5 "2013-09-20T21:23:29Z")

</div>

Thanks Justin...I had not thought of that.

James

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/broctl-and-filtering/2819/6 "2022-05-06T15:41:14Z")

</div>