# How to Set N-byte of Payload to be Processed by Bro?

**URL:** <https://community.zeek.org/t/how-to-set-n-byte-of-payload-to-be-processed-by-bro/4224>\
**Category:** Zeek\
**Created:** [July 2, 2016, 1:23pm UTC](https://community.zeek.org/t/how-to-set-n-byte-of-payload-to-be-processed-by-bro/4224 "2016-07-02T13:23:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hashem\_Alaidaros](https://avatars.discourse-cdn.com/v4/letter/h/ec9cab/32.png) [@Hashem\_Alaidaros](https://community.zeek.org/u/Hashem_Alaidaros)\
**Post date:** [July 2, 2016, 1:23pm UTC](https://community.zeek.org/t/how-to-set-n-byte-of-payload-to-be-processed-by-bro/4224/1 "2016-07-02T13:23:46Z")

</div>

Hi everyone,  
I use signature framework in Bro. I want Bro to capture and processes only the first N-bytes of each packet received. In other words, only the first N-bytes will be compared with the signature.  
How to do that?  
Aidaros

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [July 6, 2016, 4:41pm UTC](https://community.zeek.org/t/how-to-set-n-byte-of-payload-to-be-processed-by-bro/4224/2 "2016-07-06T16:41:09Z")

</div>

Hi,

There's a variable you can redefine for this, snaplen[1]. The module  
that this variable is in changed from 2.4.1 to the current git master.  
If you're on 2.4.1 or older, use "snaplen" otherwise use  
"Pcap::snaplen". If running Bro in standalone mode, you can do something  
like:

> bro -i eth0 Pcap::snaplen=1024

Otherwise, you can add this to site/local.bro:

> redef Pcap::snaplen=1024;

One thing to note is that this only applies to capturing from live  
interfaces, and not reading from PCAPs.

&nbsp;&nbsp;--Vlad

[1] - \<[https://www.bro.org/sphinx/scripts/base/init-bare.bro.html#id-snaplen&gt](https://www.bro.org/sphinx/scripts/base/init-bare.bro.html#id-snaplen&gt);

Hashem Alaidaros \<aidaros.dev@gmail.com\> writes:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/how-to-set-n-byte-of-payload-to-be-processed-by-bro/4224/3 "2022-05-06T15:43:48Z")

</div>