Exclude IPS

Zeek
1

Hi All,

I am running the latest version of Bro and I would like to exclude (not at all log) events from specific IPs.

Can someone provide me with a link/info on how to do this?

Thnx for your time.

Regards

Ioannis

2

redef restrict_filters += [[“blockedIPs”] = “not net 192.168.1.0/24”];

I think you may need to also include: redef PacketFilter::all_packets = F; I have both of these statements in my config, but I put them in there a long time ago.

3

redef restrict_filters += [[“blockedIPs”] = “not net 192.168.1.0/24”];

I think you may need to also include: redef PacketFilter::all_packets = F; I have both of these statements in my config, but I put them in there a long time ago.

4

Hi Grant

Thanks for your answer.

I tested your proposal and it runs OK for Bro 2.3.1 running in Ubuntu 14.04 except for the “OR” operator.

I had to add the second IP to an additional filter line.

Regards,

Ioannis