# Exclude IPS

**URL:** <https://community.zeek.org/t/exclude-ips/3363>\
**Category:** Zeek\
**Created:** [November 18, 2014, 5:06pm UTC](https://community.zeek.org/t/exclude-ips/3363 "2014-11-18T17:06:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ioannis.psaroudakis](https://avatars.discourse-cdn.com/v4/letter/i/cdc98d/32.png) [@ioannis.psaroudakis](https://community.zeek.org/u/ioannis.psaroudakis)\
**Post date:** [November 18, 2014, 5:06pm UTC](https://community.zeek.org/t/exclude-ips/3363/1 "2014-11-18T17:06:46Z")

</div>

Hi All,

I am running the latest version of Bro and I would like to exclude (not at all log) events from specific IPs.

Can someone provide me with a link/info on how to do this?

Thnx for your time.

Regards

Ioannis

---

<div class="post-metadata">

**Author:** ![McMahon\_Kevin\_J](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@McMahon\_Kevin\_J](https://community.zeek.org/u/McMahon_Kevin_J)\
**Post date:** [November 18, 2014, 5:43pm UTC](https://community.zeek.org/t/exclude-ips/3363/2 "2014-11-18T17:43:01Z")

</div>

redef restrict\_filters += [[“blockedIPs”] = “not net 192.168.1.0/24”];

I think you may need to also include: redef PacketFilter::all\_packets = F; I have both of these statements in my config, but I put them in there a long time ago.

---

<div class="post-metadata">

**Author:** ![Grant\_Stavely](https://avatars.discourse-cdn.com/v4/letter/g/d78d45/32.png) [@Grant\_Stavely](https://community.zeek.org/u/Grant_Stavely)\
**Post date:** [November 18, 2014, 7:14pm UTC](https://community.zeek.org/t/exclude-ips/3363/3 "2014-11-18T19:14:12Z")

</div>

redef restrict\_filters += [[“blockedIPs”] = “not net 192.168.1.0/24”];

I think you may need to also include: redef PacketFilter::all\_packets = F; I have both of these statements in my config, but I put them in there a long time ago.

---

<div class="post-metadata">

**Author:** ![ioannis.psaroudakis](https://avatars.discourse-cdn.com/v4/letter/i/cdc98d/32.png) [@ioannis.psaroudakis](https://community.zeek.org/u/ioannis.psaroudakis)\
**Post date:** [November 21, 2014, 11:23am UTC](https://community.zeek.org/t/exclude-ips/3363/4 "2014-11-21T11:23:43Z")

</div>

Hi Grant

Thanks for your answer.

I tested your proposal and it runs OK for Bro 2.3.1 running in Ubuntu 14.04 except for the “OR” operator.

I had to add the second IP to an additional filter line.

Regards,

Ioannis

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/exclude-ips/3363/5 "2022-05-06T15:42:14Z")

</div>