BPF options in Bro

#1

How would I go about creating a filter in Bro? For instance, I have syslog data being sent to another host on the network I am monitoring with ROCK which is creating a lot of unnecessary noise.

#2

@kvv5150 there’s a couple of different options, but if you just want Bro to turn a blind eye to it, you can put the following at the end of /usr/share/bro/site/local.bro. ip or not ip is the default Bro capture filter, which captures everything.

redef PacketFilter::default_capture_filter = "(ip or not ip) and not (udp port 514 and dst host 1.2.3.4)"

Where 1.2.3.4 is your syslog server. Remove dst if you want to exclude data also coming from that server using syslog (i.e. you have a tiered syslog architecture).