diff --git a/include/pfs/filter.hpp b/include/pfs/filter.hpp
new file mode 100644
index 0000000..5338c85
--- /dev/null
+++ b/include/pfs/filter.hpp
@@ -0,0 +1,31 @@
+/*
+ *  Copyright 2020-present Daniel Trugman
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+#ifndef PFS_FILTER_HPP
+#define PFS_FILTER_HPP
+
+namespace pfs {
+namespace filter {
+
+enum class action {
+    drop,
+    keep,
+};
+
+} // namespace filter
+} // namespace pfs
+
+#endif // PFS_FILTER_HPP
diff --git a/include/pfs/net.hpp b/include/pfs/net.hpp
index 922b962..723dbd4 100644
--- a/include/pfs/net.hpp
+++ b/include/pfs/net.hpp
@@ -22,6 +22,7 @@
 #include <vector>
 
 #include "types.hpp"
+#include "filter.hpp"
 
 namespace pfs {
 
@@ -42,11 +43,11 @@ class net final
     net& operator=(net&&) = delete;
 
 public:
-    using net_device_filter = std::function<bool(const net_device&)>;
-    using net_socket_filter = std::function<bool(const net_socket&)>;
-    using netlink_socket_filter = std::function<bool(const netlink_socket&)>;
-    using unix_socket_filter = std::function<bool(const unix_socket&)>;
-    using net_route_filter = std::function<bool(const net_route&)>;
+    using net_device_filter = std::function<filter::action(const net_device&)>;
+    using net_socket_filter = std::function<filter::action(const net_socket&)>;
+    using netlink_socket_filter = std::function<filter::action(const netlink_socket&)>;
+    using unix_socket_filter = std::function<filter::action(const unix_socket&)>;
+    using net_route_filter = std::function<filter::action(const net_route&)>;
 
 public:
     std::vector<net_device> get_dev(net_device_filter filter = nullptr) const;
diff --git a/include/pfs/parsers/lines.hpp b/include/pfs/parsers/lines.hpp
index bb203d2..5d7327a 100644
--- a/include/pfs/parsers/lines.hpp
+++ b/include/pfs/parsers/lines.hpp
@@ -22,6 +22,7 @@
 
 #include "pfs/parser_error.hpp"
 #include "pfs/utils.hpp"
+#include "pfs/filter.hpp"
 
 namespace pfs {
 namespace impl {
@@ -35,7 +36,7 @@ void parse_file_lines(
     const std::string& path,
     Inserter inserter,
     std::function<inserted_type<Inserter>(const std::string&)> parser,
-    std::function<bool(const inserted_type<Inserter>&)> filter = nullptr,
+    std::function<filter::action(const inserted_type<Inserter>&)> filter = nullptr,
     size_t lines_to_skip = 0)
 {
     std::ifstream in(path);
@@ -59,7 +60,7 @@ void parse_file_lines(
 
         auto inserted = parser(line);
 
-        if (filter && filter(inserted))
+        if (filter && filter(inserted) != filter::action::keep)
         {
             continue;
         }
diff --git a/sample/tool_netstat.cpp b/sample/tool_netstat.cpp
index e73411e..876e826 100644
--- a/sample/tool_netstat.cpp
+++ b/sample/tool_netstat.cpp
@@ -31,7 +31,9 @@ void task_netstat(const pfs::task& task, const std::string& type)
 
     auto inodes = task.get_fds_inodes();
     pfs::net::net_socket_filter filter = [&inodes](const pfs::net_socket& sock){
-        return inodes.find(sock.inode) == inodes.end();
+        return inodes.find(sock.inode) == inodes.end()
+            ? pfs::filter::action::keep
+            : pfs::filter::action::drop;
     };
 
     auto net = task.get_net();
diff --git a/test/test_parsers.cpp b/test/test_parsers.cpp
index d909f33..b1cd931 100644
--- a/test/test_parsers.cpp
+++ b/test/test_parsers.cpp
@@ -70,7 +70,7 @@ TEST_CASE("Parse lines functionality", "[parsers]")
     std::vector<std::string> content;
     std::vector<std::string> expected;
     std::vector<std::string> output;
-    std::function<bool(const std::string&)> filter = nullptr;
+    std::function<pfs::filter::action(const std::string&)> filter = nullptr;
     size_t skipped = 0;
 
     std::string file;
@@ -101,7 +101,9 @@ TEST_CASE("Parse lines functionality", "[parsers]")
     {
         content  = {"a", "x", "x", "b", "x", "c"};
         expected = {"a", "b", "c"};
-        filter = [](const std::string& entry) { return entry == "x"; };
+        filter = [](const std::string& entry) {
+            return entry == "x" ? pfs::filter::action::drop : pfs::filter::action::keep;
+        };
     }
 
     file = create_temp_file(content);