Hi, I am trying to write a capture filter to filter GRE traffic based on the inside IP of a GRE packet. Based on the advice given in the link below: http://novalidhostsfound.blogspot.com/2015/03/how-to-filter-ip-addresses-inside-gre.html I wrote my capture filter (see at end of the email). With t…

Looks like offsets 50 and 54 are from the ethernet layer, not ip tcpdump -r gre-sample2.pcap ‘proto gre and (ether[50:4]=0xac1c0203 or ether[54:4]=0xac1c0203)’ works, as does tcpdump -r gre-sample2.pcap “proto gre and (ip[36:4]=0xac1c0203 or ip[40:4]=0xac1c0203)” I started working this out, but …

Thanks Justin, Your suggestion works for tcpdump. However, bro is still complaining when I put in the filter. Any idea on how to get around that?

What message are you getting? I just tried this now and it appeared to work: redef capture_filters += { [“inside_ip”] = “proto gre and (ip[36:4]=0xac1c0203 or ip[40:4]=0xac1c0203)” }; it may matter if you are using a different packet source plugin though like pf_ring or af_packet.

Looks like I may have had a typo. It seems to work now. Thanks for the help.

gre capture filter

Zeek

Topic		Replies	Views
help for adding new packet filter Zeek	3	131	May 6, 2022
How does Bro capture the traffic of ftp data connection ? Zeek	2	86	May 6, 2022
Protosig question, round 2 Zeek	9	254	May 6, 2022
PacketFilter Zeek	14	163	May 6, 2022
Bro 0.8 and vlans Zeek	1	98	May 6, 2022

gre capture filter

Related topics