# Exclude IPS

**URL:** <https://community.zeek.org/t/exclude-ips/3365>\
**Category:** Zeek\
**Created:** [November 19, 2014, 12:54am UTC](https://community.zeek.org/t/exclude-ips/3365 "2014-11-19T00:54:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [November 19, 2014, 12:54am UTC](https://community.zeek.org/t/exclude-ips/3365/1 "2014-11-19T00:54:52Z")

</div>

Hi

I have exclude IP using these command

local.bro:

redef PacketFilter::enable\_auto\_protocol\_capture\_filters = F;

redef capture\_filters = { [“all”] = “ip or not ip” };

local-worker.bro:

redef restrict\_filters = { [“not-hosts”] = “not host X.X.X.X” };

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [November 19, 2014, 2:09pm UTC](https://community.zeek.org/t/exclude-ips/3365/2 "2014-11-19T14:09:09Z")

</div>

Hi Hichul!

You could actually simplify this all by just putting that last line in local.bro. The rest aren't necessary.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [November 20, 2014, 5:55am UTC](https://community.zeek.org/t/exclude-ips/3365/3 "2014-11-20T05:55:20Z")

</div>

Hi Seth  
Thank you

I put  
redef restrict\_filters = { [“not-hosts”] = “not host X.X.X.X” };

in a local.bro and it worked. very simple oneliner

Thank’s

---

<div class="post-metadata">

**Author:** ![ioannis.psaroudakis](https://avatars.discourse-cdn.com/v4/letter/i/cdc98d/32.png) [@ioannis.psaroudakis](https://community.zeek.org/u/ioannis.psaroudakis)\
**Post date:** [November 21, 2014, 11:21am UTC](https://community.zeek.org/t/exclude-ips/3365/4 "2014-11-21T11:21:06Z")

</div>

Hi all,

Thank you for your answers.

Indeed it works fine for Bro 2.3.1 running in Ubuntu 14.04.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/exclude-ips/3365/5 "2022-05-06T15:42:14Z")

</div>