# MAC Address In Logs **URL:** \ **Category:** Zeek\ **Created:** [February 19, 2019, 6:52am UTC](https://community.zeek.org/t/mac-address-in-logs/5615 "2019-02-19T06:52:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![TQ1](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@TQ1](https://community.zeek.org/u/TQ1)\ **Post date:** [February 19, 2019, 6:52am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/1 "2019-02-19T06:52:06Z")
Is there a way to include MAC address in all of the logs or custom written logs? I saw the documentation ([https://docs.zeek.org/en/latest/scripts/policy/protocols/conn/mac-logging.bro.html](https://docs.zeek.org/en/latest/scripts/policy/protocols/conn/mac-logging.bro.html)), but didn’t see any MAC addresses even though I could see them in Wireshark. Thanks, ---
**Author:** ![Michael\_Shirk](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Michael\_Shirk](https://community.zeek.org/u/Michael_Shirk)\ **Post date:** [February 19, 2019, 2:29pm UTC](https://community.zeek.org/t/mac-address-in-logs/5615/2 "2019-02-19T14:29:46Z")
You need to add the following to your local.bro script to enable it, as it is not on by default: @load policy/protocols/conn/mac-logging ---
**Author:** ![TQ1](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@TQ1](https://community.zeek.org/u/TQ1)\ **Post date:** [February 19, 2019, 11:38pm UTC](https://community.zeek.org/t/mac-address-in-logs/5615/3 "2019-02-19T23:38:39Z")
Thanks for reply Michael. So I went into /usr/local/bro/share/bro/site/local.bro and uncommented this line: @load policy/protocols/conn/mac-logging. I reran bro and checked all log files, but none contain the MAC address. This is running on Zeek 2.6.1. I’m not sure what to expect (i.e. two columns for source/destination MAC?). Maybe I’m missing another step? Thanks, ---
**Author:** ![Chris\_Walsh](https://avatars.discourse-cdn.com/v4/letter/c/b38774/32.png) [@Chris\_Walsh](https://community.zeek.org/u/Chris_Walsh)\ **Post date:** [February 20, 2019, 1:02am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/4 "2019-02-20T01:02:45Z")
In my 2.5.3 installation, the comment above the line in question says that the MAC addrs will be logged to the conn.log file. This is what happens for me. From there, they can be linked to other logs via the uid field. Are you sure that your conn.log does not have the orig\_l2\_addr and resp\_l2\_addr fields? Chris ---
**Author:** ![TQ1](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@TQ1](https://community.zeek.org/u/TQ1)\ **Post date:** [February 20, 2019, 1:40am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/5 "2019-02-20T01:40:38Z")
Hi Chris, I only see these headers for conn.log: #fields ts uid id.orig\_h id.orig\_p id.resp\_h id.resp\_p proto service duration orig\_bytes resp\_bytes conn\_state local\_orig local\_resp missed\_bytes history orig\_pkts orig\_ip\_bytes resp\_pkts resp\_ip\_bytes tunnel\_parents Using the same commands I always use: sudo ./bro -C -r ~/Desktop/pcap/test.pcap Wireshark shows MAC just fine. I don’t need to rebuild bro again, right? Just need to edit the /usr/local/bro/share/bro/site/local.bro file. The only file that shows a column for mac is the dhcp.log Thanks, ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [February 20, 2019, 2:21am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/6 "2019-02-20T02:21:56Z")
If testing with a cluster - have you re-deployed your Zeek? “broctl deploy” needs to be run after each change to scripts and configuration. You can see what scripts are loaded with the “broctl scripts” command, so just run broctl scripts | grep mac If testing with a pcap - some scripts are not loaded by default when you just run zeek from the command line. You can try with bro -C -r policy/protocols/conn/mac-logging to explicitly load this script. ---
**Author:** ![TQ1](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@TQ1](https://community.zeek.org/u/TQ1)\ **Post date:** [February 20, 2019, 4:29am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/7 "2019-02-20T04:29:04Z")
Hi Michal, This is strange. I went into the source folder bro-2.6.1/scripts/site/ and changed local.bro and even rebuild again. No MAC address in log. However, running your suggestion of “bro -C -r policy/protocols/conn/mac-logging” allows me to see MAC address in conn.log now. So do you know what exactly is the issue here? Is there a way to include MAC address in other logs such as http.log, dns.log, etc? Thanks for your help! Thanks, ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [February 20, 2019, 4:45am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/8 "2019-02-20T04:45:20Z")
It’s what I said already. Running Bro without installation, from the command line, does not load the local.bro. The mac-addr script, when loaded manually, will add your MAC address to the conn.log and nowhere else. Frankly, there is no need for that as you usually pivot between various log files. ---
**Author:** ![TQ1](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@TQ1](https://community.zeek.org/u/TQ1)\ **Post date:** [February 20, 2019, 5:14am UTC](https://community.zeek.org/t/mac-address-in-logs/5615/9 "2019-02-20T05:14:45Z")
I did install bro using “sudo ./configure && sudo make && sudo make install”, but still no MAC address unless I force loading like you suggested. I have a special use case where I need MAC address on every single custom script log, so I peeked into /usr/local/bro/share/bro/policy/protocols/conn/mac-logging.bro and noticed that I just needed to add these into the record: ## Link-layer address of the originator, if available. orig\_l2\_addr: string &log &optional; ## Link-layer address of the responder, if available. resp\_l2\_addr: string &log &optional; and these into the events: if ( c$orig?$l2\_addr ) c$conn$orig\_l2\_addr = c$orig$l2\_addr; if ( c$resp?$l2\_addr ) c$conn$resp\_l2\_addr = c$resp$l2\_addr; Everything is working great now. Thanks all for the help! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/mac-address-in-logs/5615/10 "2022-05-06T15:46:21Z")