# broctl print capture\_filters failing **URL:** \ **Category:** Zeek\ **Created:** [April 11, 2018, 7:58pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255 "2018-04-11T19:58:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Perry\_David](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry\_David](https://community.zeek.org/u/Perry_David)\ **Post date:** [April 11, 2018, 7:58pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/1 "2018-04-11T19:58:43Z")
I have a two-worker cluster running on an Ubuntu VM. Bro was installed from the packages provided by OpenSUSE. Ubuntu 16.04.4 LTS Bro 2.5.3 BroControl Version 1.7. Aside from commenting out most “@load protocols/xxx” lines, I have made minimal changes to the configuration. I am debugging capture filters but unfortunately broctl print capture\_filters throws an error. ‘broctl status’ works fine. broctl status Name Type Host Status Pid Started manager manager localhost running 11704 10 Apr 15:09:24 proxy-1 proxy localhost running 11880 10 Apr 15:09:25 worker-1 worker localhost running 11937 10 Apr 15:09:27 worker-2 worker localhost running 11938 10 Apr 15:09:27 broctl print capture\_filters manager \ proxy-1 \ worker-1 \ worker-2 \ I added ‘Debug=1’ to broctl.cfg, re-ran the commands and looked in /opt/bro/spool/debug.log but found no additional information. Perhaps I am still missing some software? Incompatible version of python-broccoli (came from Ubuntu)? David ---
**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\ **Post date:** [April 11, 2018, 8:36pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/2 "2018-04-11T20:36:32Z")
David, I have started using a different technique for debug/dumping now: I tap into "event reporter\_info" rough example : $cat a.bro redef capture\_filters += { ["my-net"] = "(vlan and not net 1.2.0.0/16) or not net 1.2.0.0/16", } ; event bro\_init() {     local \_msg = "" ;         for (a in capture\_filters)         {                \_msg = fmt ("capture-filters: %s-\> %s", a, capture\_filters[a]);                 event reporter\_info(network\_time(), \_msg, peer\_description);         } } then run as: bro -i eth0 ./a.bro $cat reporter.log | fgrep capture-filters you should see the output. event reporter\_info is a good event to tap for dumping info in a cluster setup. Basically I've used it as a cluster version of "print fmt (" used in standalone. Hope this helps, Aashish ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [April 11, 2018, 8:47pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/3 "2018-04-11T20:47:14Z")
You can just     Reporter::info(fmt ("capture-filters: %s-\> %s", a, capture\_filters[a])); ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [April 11, 2018, 9:05pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/4 "2018-04-11T21:05:57Z")
Have you verified that Bro is listening on those ports? (e.g. "netstat -ltn") ---
**Author:** ![Perry\_David](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry\_David](https://community.zeek.org/u/Perry_David)\ **Post date:** [April 11, 2018, 9:34pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/5 "2018-04-11T21:34:38Z")
Good question. Alas, 'netstat' and 'lsof' show bro listening on those ports. ---
**Author:** ![Perry\_David](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry\_David](https://community.zeek.org/u/Perry_David)\ **Post date:** [April 11, 2018, 10:07pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/6 "2018-04-11T22:07:51Z")
Thanks, Aashish. It does work. ---
**Author:** ![Perry\_David](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry\_David](https://community.zeek.org/u/Perry_David)\ **Post date:** [April 11, 2018, 10:20pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/7 "2018-04-11T22:20:18Z")
Thanks, Justin, this works well too. In both cases, when I re-run bro, the order of pieces printed is different. I don't know if this order is an artifact, or what, but I think the internal order is important -- non-vlan filters first and vlan filters after.... The thing I am trying to troubleshoot is that if I concatenate on one line all of the pieces, the filter works as expected. If I do this: > redef capture\_filters = { ["subnets"] = "(not (src net aaa.bbb.0.0/16 or src net aaa.ccc.0.0/16 or src net ddd.jjj.0.0/16 or net eee.hhh.ggg.0/28)) or (vlan and (not (src net aaa.bbb.0.0/16 or src net aaa.ccc.0.0/16 or src net ddd.jjj.0.0/16 or net eee.hhh.ggg.0/28)))" }; it works as expected. However if I do this (much neater looking): > redef capture\_filters = { > ["subnets"] = " (not (src net aaa.bbb.0.0/16 or src net aaa.ccc.0.0/16 or src net ddd.jjj.0.0/16))", > ["iris-1"] = " (not (net eee.hhh.ggg.0/28))", > ["subnets\_V"] = "(vlan and (not (src net aaa.bbb.0.0/16 or src net aaa.ccc.0.0/16 or src net ddd.jjj.0.0/16)))", > ["iris-1\_V"] = "(vlan and (not (net eee.hhh.ggg.0/28)))" > }; I do not get the same behavior. David ---
**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\ **Post date:** [April 11, 2018, 10:46pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/8 "2018-04-11T22:46:06Z")
Use of vlan in bpf filters can be problematic. See: [https://stackoverflow.com/questions/31136182/libpcap-filter-strings-using-vlan-are-behaving-weirdly](https://stackoverflow.com/questions/31136182/libpcap-filter-strings-using-vlan-are-behaving-weirdly) I don’t think the “much neater looking” bpf fragments are necessarily being applied in the same order that you specify them as the order of traversal through a table is not specified. Hope this helps. ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [April 12, 2018, 12:51pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/9 "2018-04-12T12:51:57Z")
Oh, Aashish forwarded this to me off list and I didn't realize it was actually posted here. I'll give a version of the email I sent off list to hopefully explain this situation in more detail for everyone else too. The fact that these filters have vlan tags makes this all super complicated (as Jim pointed out, thanks!). Generally I recommend that if people have vlan tags, they don't try to do filtering because it's going to be seriously mind bending. Unfortunately, at the moment I have a hard time make a suggestion for a filter if you want to use capture\_filters, as you've discovered that can be complicated based on how filter fragments are combined. You may want to use the full filter you wrote and use that as a 'cmd\_line\_bpf\_filter' variable. I wouldn't normally recommend using the 'cmd\_line\_bpf\_filter' variable because it closes some doors of functionality but there isn't a good way to avoid it in this case. redef cmd\_line\_bpf\_filter = "(not (src net aaa.bbb.0.0/16 or src net aaa.ccc.0.0/16 or src net ddd.jjj.0.0/16 or net eee.hhh.ggg.0/28)) or (vlan and (not (src net aaa.bbb.0.0/16 or src net aaa.ccc.0.0/16 or src net ddd.jjj.0.0/16 or net eee.hhh.ggg.0/28)))"; I did want to make one other comment about the filter. You almost certainly don't want to use "src" or "dst" in your filters. Because that filtering is done at the packet level, even if the filter works correctly it means that you'll only see a single direction of traffic which will also be bad for Bro. Most of Bros functionality expects to see both directions of conversations and won't work as well if both sides aren't there. So the line I would actually recommend running is this... redef cmd\_line\_bpf\_filter = "(not (net aaa.bbb.0.0/16 or net aaa.ccc.0.0/16 or net ddd.jjj.0.0/16 or net eee.hhh.ggg.0/28)) or (vlan and (not (net aaa.bbb.0.0/16 or net aaa.ccc.0.0/16 or net ddd.jjj.0.0/16 or net eee.hhh.ggg.0/28)))"; VLAN tags and BPF filtering are never any fun.    .Seth ---
**Author:** ![Perry\_David](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Perry\_David](https://community.zeek.org/u/Perry_David)\ **Post date:** [April 12, 2018, 3:21pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/10 "2018-04-12T15:21:20Z")
Jim, Thanks very much. That is a helpful article. I had known about the VLAN pitfalls from bitter experience and think I navigated around them in the way I intended in the original ‘long’ version of the filter. I think the opening line summarizes pretty well "`vlan` is weird." I am pretty convinced now that the fragments are being applied in some non-deterministic order, which makes them useless for my application, unfortunately. David ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/broctl-print-capture-filters-failing/5255/11 "2022-05-06T15:45:42Z")