Help，About Packet Filter

Zeek
1

Hi，friends:

I use restrict_filters to filter the traffic. but the settings did not take effect, all of the traffic was filtered. What should I do?

My script is as follows:

redef restrict_filters += {

      ["unmonitored host"] = "host 123.2.15.75"
};



I am looking forwoard to your replay. Thakns.
2

Is your traffic encapsulated with vlan tags? Does changing the filter to

    vlan and host 123.2.15.75

work any better?

3

Hi,
I tested the config you provided, but it didn’t work. I read the source code and used the following config for traffic filtering. It’s not perfect.

Iredef packet_filter_default = F;

event zeek_init()
{
    install_src_addr_filter($ip=123.2.15.75, $tcp_flags=63, $prob=1.0);

    install_src_addr_filter($ip=123.2.15.75, $tcp_flags=1, $prob=1.0);

    install_src_addr_filter($ip=123.2.15.75, $tcp_flags=2, $prob=1.0);

    install_src_addr_filter($ip=123.2.15.75, $tcp_flags=4, $prob=1.0);
...


}