packet-filter

The packet filter framework supports how Zeek sets its BPF capture filter.

This script supports how Zeek sets its BPF capture filter. By default Zeek sets a capture filter that allows all traffic. If a filter is set on the command line, that filter takes precedence over the default open filter and all filters defined in Zeek scripts with the capture_filters and restrict_filters variables.

base/frameworks/packet-filter/netstats.zeek

This script reports on packet loss from the various packet sources. When Zeek is reading input from trace files, this script will not report any packet loss statistics.