# File extraction exclude local sites

**URL:** <https://community.zeek.org/t/file-extraction-exclude-local-sites/2988>\
**Category:** Zeek\
**Created:** [February 1, 2014, 10:53pm UTC](https://community.zeek.org/t/file-extraction-exclude-local-sites/2988 "2014-02-01T22:53:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Kolkebeck](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Mike\_Kolkebeck](https://community.zeek.org/u/Mike_Kolkebeck)\
**Post date:** [February 1, 2014, 10:53pm UTC](https://community.zeek.org/t/file-extraction-exclude-local-sites/2988/1 "2014-02-01T22:53:50Z")

</div>

Does anyone have a solution to exclude extracting files transmitted from internal hosts?

I modified the script below from the bro exchange exercise, but I continue to get executable files from internal hosts. I am using broctl and networks.cfg is populated. I haven’t tried using the file\_over\_new\_connection event yet, but I would prefer to use file\_new event, if I can. Any ideas on what I’m doing wrong?

Thanks!  
Mike

global ext\_map: table[string] of string = {  
[“application/x-dosexec”] = “exe”,  
} &default ="";

event file\_new(f: fa\_file)  
{  
if ( ! f?$mime\_type || f$mime\_type != “application/x-dosexec” )  
return;

if ( ! f?$info || ! f$info?$tx\_hosts )  
return;

for ( txhost in f$info$tx\_hosts )  
{  
if ( Site::is\_local\_addr(txhost) )  
return;  
}

local ext = “”;

if ( f?$mime\_type )  
ext = ext\_map[f$mime\_type];

local fname = fmt("%s-%s.%s", f$source, f$id, ext);  
Files::add\_analyzer(f, Files::ANALYZER\_EXTRACT, [$extract\_filename=fname]);  
}

---

<div class="post-metadata">

**Author:** ![Marius\_Portaas\_Hauge](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@Marius\_Portaas\_Hauge](https://community.zeek.org/u/Marius_Portaas_Hauge)\
**Post date:** [February 2, 2014, 1:26pm UTC](https://community.zeek.org/t/file-extraction-exclude-local-sites/2988/2 "2014-02-02T13:26:23Z")

</div>

Hi Mike,

I have planned to do something similar myself, and I'm planning on using the  
local\_orig variable and test for something like  
if(f$info?$local\_org) return;

but I haven't tried it out yet.  
From the documentation ([http://www.bro.org/sphinx-git/scripts/base/frameworks/files/main.bro.html#type-Files::Info](http://www.bro.org/sphinx-git/scripts/base/frameworks/files/main.bro.html#type-Files::Info)):

local\_orig: bool &log &optional  
If the source of this file is a network connection, this field indicates if the data originated from the local network or not as determined by the configured Site::local\_nets.

Maybe this could work?

Best regards,  
Marius P. Haugen

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/file-extraction-exclude-local-sites/2988/3 "2022-05-06T15:41:33Z")

</div>

Closed on May 6, 2022, 3:41pm UTC