# Zeek filters problem
**URL:** https://community.zeek.org/t/zeek-filters-problem/7954
**Category:** Zeek
**Created:** [March 10, 2026, 9:22am UTC](https://community.zeek.org/t/zeek-filters-problem/7954 "2026-03-10T09:22:19Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jannitand](https://community.zeek.org/u/jannitand)
#### Post date: [March 10, 2026, 9:22am UTC](https://community.zeek.org/t/zeek-filters-problem/7954/1 "2026-03-10T09:22:19Z")
Hello, I’m new to zeek so my apologies if I’m asking a nonsense question.
I’ve installed Zeek as a network monitoring tool in a network which is not under my administration.
The port mirroring in the interface zeek is listening to was configured erroneously and it is sending algo the local traffic, which I do not want to analyze.
My filter looks like this in `/opt/zeek/share/zeek/site/local.zeek`
```auto
redef restrict_filters = {
["avoid local traffic"] = "not (dst net 172.16.0.0/12 or dst net 192.168.0.0/16 or dst net 10.0.0.0/8) and not (src net 172.16.0.0/12 or src net 192.168.0.0/16 or src net 10.0.0.0/8)",
};
```
But still is capturing local traffic
What Am I doing wrong?
Thank you!
---
### Author:  [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [March 12, 2026, 5:11pm UTC](https://community.zeek.org/t/zeek-filters-problem/7954/2 "2026-03-12T17:11:24Z")
Hi @jannitand,
on a first glance, your filter syntax looks correct to me - and should indeed achieve what you want to accomplish.
how are you acquiring packets? Is Zeek listening directly to interfaces, or are you using something like AF\_PACKET to ingest packets?
If you are using AF\_PACKET, or similar, I think the bpf filter will not be used as the method of packet capture completely bypasses the normal packet processing pipeline.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 9, 2026, 9:22am UTC](https://community.zeek.org/t/zeek-filters-problem/7954/3 "2026-05-09T09:22:50Z")
This topic was automatically closed after 60 days. New replies are no longer allowed.