#pcap-filter to use (only matching packets captured)

group_dark=${LANDER_GROUPS[host]}

#scrub, but pass all ips unchanged
process_dark() {
    local _inpfile=$1 _real_kh= _anon_hopt= 
    _real_kh=$($READLINK $LANDER_KEYHOST_FILE)
    _anon_dopt="-c -R"

    process_out="$_inpfile-d"
    [ -z "$LANDER_DARKNET_FILTER" ] && { 
        echo "ERROR: LANDER_DARKNET_FILTER is not set" >&2
        return 1
    }
    if $LANDER_SCRUBBER -l $LANDER_SCRUBBER_LOGFILE -F "$LANDER_DARKNET_FILTER" \
        $_anon_dopt "$_inpfile" "$process_out"; then
        # Scrubbing worked
	    chgrp $group_dark "$process_out"
	    return 0
    fi
    return 1
}

#hook it up into processing (these should be set in lander.conf)
#LANDER_RAW_HOOKS+="dark "
#LANDER_DARKNET_FILTER="ip and (net 128.9.237.0/24 or net 128.9.238.0/24)"
