PCAP help

Zeek
1

Hello Bro Team,

I need some help with PCAP.

We noticed when using Bro we see local host traffic.

We want to segment Bro’s traffic from the other traffic on a continual basis.

We cannot find any information on the net how to do this, so now I must reach out to you.

All traffic inbound comes into Bro and at that point we need to all of its own traffic segmented away somewhere.

Can you help me ?

Can you please send explicit directions for this.

Respectfully Yours

Charles McKee

DecisivEdge**, LLC**

O: 302.299.1570 x432 | C: 302.320.6968 | F: 302.299.1578

131 Continental Dr | Suite 409 | Newark, DE 19713

charles.mckee@decisivedge.com | www.DecisivEdge.com

2

So what interface is Bro monitoring? and have you configured your
networks.cfg? Need some more details on what traffic you are having
issues splitting out.

3

It is advised to not monitor the same network you use to connect to
the Bro sensor, but you can ignore all of the traffic involving the
Bro sensor with bpf filter by adding the following to your local.bro:

redef cmd_line_bpf_filter = "not (host BROIPADDRESS)";