# local network warning

**URL:** <https://community.zeek.org/t/local-network-warning/5452>\
**Category:** Zeek\
**Created:** [September 11, 2018, 7:37pm UTC](https://community.zeek.org/t/local-network-warning/5452 "2018-09-11T19:37:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![john\_Y1](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@john\_Y1](https://community.zeek.org/u/john_Y1)\
**Post date:** [September 11, 2018, 7:37pm UTC](https://community.zeek.org/t/local-network-warning/5452/1 "2018-09-11T19:37:14Z")

</div>

Hi there!

when i run bro command : “bro -r ./file.pcap ./script\_path” warning is being shown : “no site :: local\_nets have not been defined. its good idea to define your local network.”

Why is it recommended to define local network, althogh i am reading pcap file?  
How do i define the network? where?

love for some help,  
john

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [September 11, 2018, 8:45pm UTC](https://community.zeek.org/t/local-network-warning/5452/2 "2018-09-11T20:45:26Z")

</div>

> when i run bro command : "bro -r ./file.pcap ./script\_path" warning is being shown : "no site :: local\_nets have not been defined. its good idea to define your local network."
> 
> Why is it recommended to define local network, althogh i am reading pcap file?

It's just a suggestion and typically only seen if you load the  
tunings/defaults/warnings.bro script usually via site/local.bro. It's  
recommended because some scripts make decisions based on it and raise  
notices only if an event in question concerns a host in a local  
network. If you're only interested in using Bro for the just the  
protocol analysis aspect of things and not interested in these sorts  
of policy decisions that it can make, you can probably just ignore the  
warning.

> How do i define the network? where?

You can load a custom script that does something like:

&nbsp;&nbsp;&nbsp;&nbsp;redef Site::local\_nets += { 192.168.0.0/16, 10.0.0.0/8 };

Or just add it to the command-line:

&nbsp;&nbsp;&nbsp;&nbsp;bro -r ./file.pcap ./script\_path "Site::local\_nets += {  
192.168.0.0/16, 10.0.0.0/8 }"

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/local-network-warning/5452/3 "2022-05-06T15:46:03Z")

</div>