# expression rejects all packets

**URL:** <https://community.zeek.org/t/expression-rejects-all-packets/187>\
**Category:** Zeek\
**Created:** [September 13, 2001, 3:23am UTC](https://community.zeek.org/t/expression-rejects-all-packets/187 "2001-09-13T03:23:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bill\_Fenner](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@Bill\_Fenner](https://community.zeek.org/u/Bill_Fenner)\
**Post date:** [September 13, 2001, 3:23am UTC](https://community.zeek.org/t/expression-rejects-all-packets/187/1 "2001-09-13T03:23:08Z")

</div>

I take it back; I do know what's going on after all. The problem is that  
gen\_vlan() has a static variable that remembers whether it has adjusted  
the offsets for the VLAN header yet; this static variable doesn't get  
reset on the second pcap\_compile() so the offset doesn't get adjusted  
the second time around, so this is like "ether type 0x8100 and ether  
type 0x800", which is why it optimizes to "reject all".

I'll see if I can come up with a fix.

&nbsp;&nbsp;Bill

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/expression-rejects-all-packets/187/2 "2022-05-06T15:36:22Z")

</div>


