# \[EXTERNAL\] Bro Digest, Vol 108, Issue 12

**URL:** <https://community.zeek.org/t/external-bro-digest-vol-108-issue-12/3555>\
**Category:** Zeek\
**Created:** [April 14, 2015, 7:35pm UTC](https://community.zeek.org/t/external-bro-digest-vol-108-issue-12/3555 "2015-04-14T19:35:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\
**Post date:** [April 14, 2015, 7:35pm UTC](https://community.zeek.org/t/external-bro-digest-vol-108-issue-12/3555/1 "2015-04-14T19:35:37Z")

</div>

> And a big +1 to this. Would love to be able to filter VLAN's as well  
> as we have listen to physical interfaces that have other interfaces  
> mirrored that include some unwanted VLAN's.
> 
> James

I thought, if you are hoping to filter out traffic by VLANs, you can do a  
PCAP filter. Is that not true?

In my case, we do want to process different VLANs, but we need to log  
through which links the traffic was observed.

---

<div class="post-metadata">

**Author:** ![Adam\_Pumphrey1](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Adam\_Pumphrey1](https://community.zeek.org/u/Adam_Pumphrey1)\
**Post date:** [April 15, 2015, 1:36pm UTC](https://community.zeek.org/t/external-bro-digest-vol-108-issue-12/3555/2 "2015-04-15T13:36:11Z")

</div>

> I thought, if you are hoping to filter out traffic by VLANs, you can do a  
> PCAP filter. Is that not true?

That’s correct, you can include or exclude VLAN traffic using Bro capture filters. I believe PacketFilter::restricted\_filter from the PacketFilter framework is for doing just that ([https://www.bro.org/sphinx/scripts/base/frameworks/packet-filter/main.bro.html](https://www.bro.org/sphinx/scripts/base/frameworks/packet-filter/main.bro.html)).

In fact, you need to use the VLAN keyword to do any IP filtering of VLAN tagged (802.1q) traffic. It won’t work correctly otherwise.

You can specify VLAN ID’s also, ex: not (van 100 or vlan 101).

You may also encounter multiple VLAN tags on a single packet, there you’ll need the correct number of VLAN keywords, ex: (vlan 100 and vlan 101).

You could see asynchronous tagging where traffic from a particular stream heading in one direction has 1 tag and traffic going in the opposite direction has 2 or more, so directionality matters also.

This is all true for MPLS encapsulated traffic too. The filtering behavior is basically the same from what I’ve seen.

> In my case, we do want to process different VLANs, but we need to log  
> through which links the traffic was observed.

I agree, it would be helpful to have VLAN ID(’s) available in conn records if they are present. Its valuable info when your troubleshooting tap and traffic mirroring configurations in complex environments.

Adam

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/external-bro-digest-vol-108-issue-12/3555/3 "2022-05-06T15:42:35Z")

</div>