Exclude IPS

Zeek
1

Hi

I have exclude IP using these command

local.bro:

redef PacketFilter::enable_auto_protocol_capture_filters = F;

redef capture_filters = { [“all”] = “ip or not ip” };

local-worker.bro:

redef restrict_filters = { [“not-hosts”] = “not host X.X.X.X” };

2

Hi Hichul!

You could actually simplify this all by just putting that last line in local.bro. The rest aren't necessary.

  .Seth

3

Hi Seth
Thank you

I put
redef restrict_filters = { [“not-hosts”] = “not host X.X.X.X” };

in a local.bro and it worked. very simple oneliner

Thank’s

4

Hi all,

Thank you for your answers.

Indeed it works fine for Bro 2.3.1 running in Ubuntu 14.04.