# Filtering PacketFilter::Dropped\_Packets
**URL:** https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293
**Category:** Zeek
**Created:** [April 17, 2012, 12:18am UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293 "2012-04-17T00:18:52Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)
#### Post date: [April 17, 2012, 12:18am UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/1 "2012-04-17T00:18:52Z")
I've got this: Log::disable\_stream(PacketFilter::LOG);
But I'm still getting a ton of "PacketFilter::Dropped\_Packets" to notice.log.
What do I need to do to disable these messages?
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [April 17, 2012, 11:34am UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/2 "2012-04-17T11:34:17Z")
Notice processing docs:
[http://www.bro-ids.org/documentation/notice.html](http://www.bro-ids.org/documentation/notice.html)
You can use the notice ignore shortcut because you want to completely ignore a notice type:
[http://www.bro-ids.org/documentation/notice.html#id7](http://www.bro-ids.org/documentation/notice.html#id7)
redef Notice::ignored\_types += { PacketFilter::Dropped\_Packets };
.Seth
---
### Author:  [@Will](https://community.zeek.org/u/Will)
#### Post date: [April 17, 2012, 12:51pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/3 "2012-04-17T12:51:33Z")
> > But I'm still getting a ton of "PacketFilter::Dropped\_Packets" to notice.log.
> > What do I need to do to disable these messages?
>
> Notice processing docs:
> [http://www.bro-ids.org/documentation/notice.html](http://www.bro-ids.org/documentation/notice.html)
>
> You can use the notice ignore shortcut because you want to completely ignore a notice type:
> [http://www.bro-ids.org/documentation/notice.html#id7](http://www.bro-ids.org/documentation/notice.html#id7)
>
> redef Notice::ignored\_types += { PacketFilter::Dropped\_Packets };
That didn't appear to completely work for me as the default action
still seemed to be applied.
I changed it to this:
redef Notice::policy += { [$pred(n: Notice::Info) = {return n$note ==
PacketFilter::Dropped\_Packets; }, $action = Notice::ACTION\_NONE, $halt
= T] };
Before adding '$halt=T', the action in the log listed both ACTION\_NONE
and ACTION\_LOG.
-will
---
### Author:  [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)
#### Post date: [April 17, 2012, 1:41pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/4 "2012-04-17T13:41:29Z")
Looks like Will's method is working. Thanks much!
---
### Author:  [@robin](https://community.zeek.org/u/robin)
#### Post date: [April 17, 2012, 2:40pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/5 "2012-04-17T14:40:19Z")
That are going through the notice framework and can be suppressed
there with something like this:
redef Notice::ignored\_types += {
PacketFilter::Dropped\_Packets
};
Robin
---
### Author:  [@robin](https://community.zeek.org/u/robin)
#### Post date: [April 17, 2012, 3:02pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/6 "2012-04-17T15:02:32Z")
That sounds like a bug then. Can you file a ticket please?
Robin
---
### Author:  [@Will](https://community.zeek.org/u/Will)
#### Post date: [April 17, 2012, 3:18pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/7 "2012-04-17T15:18:10Z")
Sure thing.
-will
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [April 17, 2012, 4:05pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/8 "2012-04-17T16:05:04Z")
Thanks, it definitely sounds like a bug.
.Seth
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [April 17, 2012, 4:19pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/9 "2012-04-17T16:19:21Z")
Everything implemented internally should make this work. There is one thing I'm wondering though. In any of your scripts you're running locally, are you doing…
redef Notice::policy = { … };
Instead of…
redef Notice::policy += { … };
It's a small difference, but causes a big change because those shortcuts (like ignored\_types) are basically just pre-implemented notice policy items which you are blowing away if you do full set assignment instead of adding items to the set. I'll start trying to think of way to make that more resilient to this too. This fragility is the one thing I don't like about those pre-implemented policy items.
.Seth
---
### Author:  [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)
#### Post date: [April 17, 2012, 5:53pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/10 "2012-04-17T17:53:20Z")
Nope, not doing that.
---
### Author:  [@Will](https://community.zeek.org/u/Will)
#### Post date: [April 17, 2012, 9:33pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/11 "2012-04-17T21:33:25Z")
> > Looks like Will's method is working. Thanks much!
>
> Everything implemented internally should make this work. There is one thing I'm wondering though. In any of your scripts you're running locally, are you doing…
>
> redef Notice::policy = { … };
>
> Instead of…
>
> redef Notice::policy += { … };
Yes, all my are just like the example above, "+=", so I assume I was
just appending another action to the table.
Maybe not a bug then?
If I do a full re-assignment "=" instead, I wouldn't have multiple
actions assigned to the notice?
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/filtering-packetfilter-dropped-packets/2293/12 "2022-05-06T15:40:18Z")