Browse docson_network_recv

On this page

Lifecycle event

`on_network_recv`

Runs for each captured packet arriving at this PC, and for forwarded packets that are not leaving through the selected interface, while network capture is active.

Syntax

Atlas Script

event on_network_recv() { }

Return value

See the remarks for the returned value and runtime behavior.

Remarks

Runs for each captured packet arriving at this PC, and for forwarded packets that are not leaving through the selected interface, while network capture is active. Use packet.* to inspect or edit it, and packet.drop() to block it.

Examples

Block traffic to and from one address.atlas

const string BLOCKED = "192.0.2.10";

event on_start() {
    if (!network.capture("ip.DstAddr == 192.0.2.10 or ip.SrcAddr == 192.0.2.10")) {
        system.log("Network capture could not start");
    }
}

event on_network_send() {
    if (packet.dst_ip == BLOCKED) {
        packet.drop();
    }
}

event on_network_recv() {
    if (packet.src_ip == BLOCKED) {
        packet.drop();
    }
}