Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

If IPv6 default is not compiled in, the default BPF filters now

Browse source 
excludes IPv6 packets.
This commit is contained in:
Robin Sommer 2011-05-10 18:10:32 -07:00
parent ee872c12c8
commit 0815ea9188
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
policy/pcap.bro
View file

@ -58,8 +58,13 @@ function build_default_pcap_filter(): string
return cmd_line_bpf_filter; return cmd_line_bpf_filter;
if ( all_packets ) if ( all_packets )
{
# Return an "always true" filter. # Return an "always true" filter.
return "ip or not ip"; if ( bro_has_ipv6() )
return "ip or not ip";
else
return "not ip6";
}
## Build filter dynamically. ## Build filter dynamically.
@ -76,6 +81,10 @@ function build_default_pcap_filter(): string
# Finally, join them. # Finally, join them.
local filter = join_filters(cfilter, rfilter); local filter = join_filters(cfilter, rfilter);
# Exclude IPv6 if we don't support it.
if ( ! bro_has_ipv6() )
filter = fmt("(not ip6) and (%s)", filter);
return filter; return filter;
} }