# Removing tags from traffic

**URL:** <https://community.zeek.org/t/removing-tags-from-traffic/864>\
**Category:** Zeek\
**Created:** [September 19, 2005, 9:56pm UTC](https://community.zeek.org/t/removing-tags-from-traffic/864 "2005-09-19T21:56:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joncarlo\_Ruggieri1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Joncarlo\_Ruggieri1](https://community.zeek.org/u/Joncarlo_Ruggieri1)\
**Post date:** [September 19, 2005, 9:56pm UTC](https://community.zeek.org/t/removing-tags-from-traffic/864/1 "2005-09-19T21:56:05Z")

</div>

Hi,

Our Network Operations Center made some changes to the infrastructure, and  
now all traffic seen by our Bro systems is tagged. As a result, Bro is  
not capturing traffic (or so it seems). Is it possible to configure Bro  
to remove or ignore the tags? Are there any (other) suggestions?

We are also checking with our NOC to see if they can un-tag the traffic.

Thanks!

Jon Ruggieri  
University of CA, Davis  
Data Center & Client Services

---

<div class="post-metadata">

**Author:** ![Adam\_Greenhalgh](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Adam\_Greenhalgh](https://community.zeek.org/u/Adam_Greenhalgh)\
**Post date:** [September 19, 2005, 10:09pm UTC](https://community.zeek.org/t/removing-tags-from-traffic/864/2 "2005-09-19T22:09:05Z")

</div>

# Make any changes to policy starting here

@load vlan

try adding that to \<[machine.site.com](http://machine.site.com)\>.bro in /usr/local/bro/site

adam

---

<div class="post-metadata">

**Author:** ![Scott\_Campbell](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Scott\_Campbell](https://community.zeek.org/u/Scott_Campbell)\
**Post date:** [September 19, 2005, 10:18pm UTC](https://community.zeek.org/t/removing-tags-from-traffic/864/3 "2005-09-19T22:18:51Z")

</div>

Joncarlo Ruggieri wrote:

> Hi,
> 
> Our Network Operations Center made some changes to the infrastructure, and  
> now all traffic seen by our Bro systems is tagged. As a result, Bro is  
> not capturing traffic (or so it seems). Is it possible to configure Bro  
> to remove or ignore the tags? Are there any (other) suggestions?
> 
> We are also checking with our NOC to see if they can un-tag the traffic.
> 
> Thanks!
> 
> Jon Ruggieri  
> University of CA, Davis  
> Data Center & Client Services
> 
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_  
> Bro mailing list  
> bro@bro-ids.org  
> [mailman.icsi.berkeley.edu Mailing Lists](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro)

You are referring to vlan tagging? If so, try adding vlan.bro policy to your config and you should get better results. Note this will prevent you from seeing any non-vlan traffic.

scott

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/removing-tags-from-traffic/864/4 "2022-05-06T15:37:41Z")

</div>