# Exclude IPS - only src ip

**URL:** <https://community.zeek.org/t/exclude-ips-only-src-ip/3397>\
**Category:** Zeek\
**Created:** [December 15, 2014, 11:08am UTC](https://community.zeek.org/t/exclude-ips-only-src-ip/3397 "2014-12-15T11:08:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [December 15, 2014, 11:08am UTC](https://community.zeek.org/t/exclude-ips-only-src-ip/3397/1 "2014-12-15T11:08:15Z")

</div>

HI

I used to filter ip by adding this command to local.bro

redef restrict\_filters = { [“not-hosts”] = “not host X.X.X.X” };

but now I want to filter out only src\_ip(in bro id.orig\_h)  
I tried  
redef restrict\_filters = { [“not-nets”] = “not src net X.X.X.X” };

redef restrict\_filters = { [“not-nets”] = “!src net X.X.X.X” };

redef restrict\_filters = { [“not-nets”] = “not(src net X.X.X.X)” };

but it does not filter a ip I want from src\_ip

it there a way to filter out only a src\_ip?

Thank you

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 15, 2014, 3:09pm UTC](https://community.zeek.org/t/exclude-ips-only-src-ip/3397/2 "2014-12-15T15:09:06Z")

</div>

Are you sure you really want to filter a src address? Because Bro typically needs full duplex traffic to work correctly, it rarely makes sense to filter with a src or dst.

Do you also have multiple “redef restrict\_filters” line as you showed? You are doing full value assignment by using “=“ instead of extending the table with “+=“ which will definitely cause you trouble if that’s happening.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [December 16, 2014, 1:55am UTC](https://community.zeek.org/t/exclude-ips-only-src-ip/3397/3 "2014-12-16T01:55:07Z")

</div>

src\_ip I want to filter out is a ‘proxy web server ip’. I want to watch only local net work log.  
There is to much proxy\_src\_ip log that we do not need, other reason is to reduce log amount  
(I am getting live traffic by mirror which our customer is doing, so I do not have any choice)

I did not write multiple “redef restrict\_filters” line. I ran one line at a time.

Thank you

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 16, 2014, 3:42pm UTC](https://community.zeek.org/t/exclude-ips-only-src-ip/3397/4 "2014-12-16T15:42:14Z")

</div>

I believe you’re over-thinking this. Just remove the “src” from your expressions. Try something like this…

redef restrict\_filters += {  
&nbsp;&nbsp;["not-nets"] = "not net 1.2.3.0/24”  
};

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/exclude-ips-only-src-ip/3397/5 "2022-05-06T15:42:18Z")

</div>