# help for adding new packet filter

**URL:** <https://community.zeek.org/t/help-for-adding-new-packet-filter/1127>\
**Category:** Zeek\
**Created:** [February 19, 2007, 10:22am UTC](https://community.zeek.org/t/help-for-adding-new-packet-filter/1127 "2007-02-19T10:22:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bindiya\_V\_S](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bindiya\_V\_S](https://community.zeek.org/u/Bindiya_V_S)\
**Post date:** [February 19, 2007, 10:22am UTC](https://community.zeek.org/t/help-for-adding-new-packet-filter/1127/1 "2007-02-19T10:22:24Z")

</div>

Hi guys,

I am trying to integrate GRE protocol in BRO. When I tried  
adding pcap filter for the protocol - by adding the following  
lines in the bro file in site directory  
redef capture\_filters = { ["tcp"]= "tcp", ["udp"] = "udp", ["icmp"] = "icmp", ["gre"] = "gre" };

it is giving the following run-time error.

line 1: run-time error: precompile\_pcap\_filter: pcap\_compile((((gre) or (udp)) or (tcp)) or (icmp)): parse error  
can't compile filter (((gre) or (udp)) or (tcp)) or (icmp)

When using 1.1, I was able to use empty capture filter - by adding the following line in the hostname.bro file -  
redef capture\_filters = { };  
and get all the packets captured. The same is not working for  
1.2 version.

Somebody please help me out.

Thanks,  
Bindiya V S

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [February 19, 2007, 6:38pm UTC](https://community.zeek.org/t/help-for-adding-new-packet-filter/1127/2 "2007-02-19T18:38:00Z")

</div>

> line 1: run-time error: precompile\_pcap\_filter: pcap\_compile((((gre) or (udp)) or (tcp)) or (icmp)): parse error  
> can't compile filter (((gre) or (udp)) or (tcp)) or (icmp)

The problem is that tcpdump (at least my version) doesn't have a "gre"  
keyword. So, to specify that you want to capture GRE traffic, you'll need  
to describe it dirctly in terms of the IP "protocol" field (e.g., "tcp"  
is the same as "ip proto 6").

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Bindiya\_V\_S](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bindiya\_V\_S](https://community.zeek.org/u/Bindiya_V_S)\
**Post date:** [February 20, 2007, 3:22am UTC](https://community.zeek.org/t/help-for-adding-new-packet-filter/1127/3 "2007-02-20T03:22:47Z")

</div>

Thanks  
That fixed it 🙂

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/help-for-adding-new-packet-filter/1127/4 "2022-05-06T15:38:10Z")

</div>