I am having an issue with changing my restrict_filters that I setup a while back. I don’t know if I am just forgetting how this works, but if someone can help me out here it would be much appreciated.
Previously I had added a section to my local.bro file to restrict the traffic some of my nodes are seeing. I used the following syntax with some dummy IP’s for an example:
const idsvm4_hosts = “192.168.0.1 or 192.168.0.2”;
redef PacketFilter::enable_auto_protocol_capture_filters = T;
redef capture_filters = { [“all”] = “ip or not ip” };
redef restrict_filters = { [“local-src”] = “src host (”+idsvm4_hosts+")" };
redef restrict_filters += { [“local-dst”] = “dst host (”+idsvm4_hosts+")" };
When I did this, I could use the print command in broctl to see that it was in fact working as expected. (print restrict_filters idsvm4)
Now I am trying to change this list, and so I have edited the const I declared previously. I added a few hosts to idsvm4_hosts, and I did an install and restart. When I run the same print, I get back the original restrict_filters. It looks like the node keeps the old one.
while troubleshooting this I have gone as far as to completely remove all my code about packet filters. I issued an install, and restarted the entire cluster. Still the print statement returns with the ORIGINAL restrict_filters I set a few months ago. I feel like I must be missing something here, but I just can’t remember what I did. I know I made this variable so that in the future I could easily update it, but here I am trying to update it with no success.