Example of my filter: "not broadcast and not multicast and not src net 192.168.1.0/24" and don't want to capture data from IP range: 146.170.1.1 - 146.170.255.255 and 226.111.1.1 - 226.111.255.255 asked 27 Apr '16, 04:14  myszoor edited 27 Apr '16, 04:16 |
3 Answers:
If you want to exclude subnet ranges completely you'll need to explicitly exclude both source and destination IP ranges, e.g.:
answered 27 Apr '16, 04:29  Jasper ♦♦ |
The simple answer would be If you do want to see traffic in the x.x.0.0/24 subnets, then you'll have to "or" in those networks, e.g. answered 27 Apr '16, 04:43  grahamb ♦ This
works fine - thanks :) Have one more question - how add to this filter: "not broadcast and not multicast and not src net 192.168.1.0/24" exception "192.168.1.111". Overall idea is: want ignore all local network traffic with exception of traffic beetwen IP "192.168.1.111" (on 192.168.1.111 is working WS) and Internet. In Internet traffic want ignore IP from range 146.170.0.0/16 and 226.111.0.0/16 (beacuse hosts from this IP ranges are trusted for me). (27 Apr '16, 05:34) myszoor
(27 Apr '16, 05:36) sindy |
Hi all, is it correct the below filter for his aim in your opinion ? (not broadcast and not multicast and not ip src net 192.168.1.0/24) or (not ip net 146.170.0.0/16 or not ip net 226.111.0.0/16) Have a nice day answered 27 Apr '16, 05:16  ValerioItaly It is not correct at least because @grahamb's answer is the closest one so far. Let's wait for OP's update and eventually adjust that one accordingly. But basically (27 Apr '16, 05:34) sindy |
@Jasper,
the OP asks for a capture filter so the syntax is not the correct one; in capture filter,
not net 146.170.0.0/16would cover bothsrcanddstbut he's asked forsrconly (data from IP range)the OP has specially asked for a range so 146.170.0.0/16 won't do as 146.170.0.0/24, 146.170.1.0/32 and 146.170.1.1/32 should be let through unless he's made a mistake.
right... my bad about the capture filter syntax, I read the question too fast I guess. :-)
The question wording is a bit unspecific - he gives an example with broadcast and multicast and a src range and say "AND don't want to..." which lead me to assume that he want's to expand the example. I assumed also that the ranges should not appear at all, so a src filter only wouldn't do.
And yes, I assumed the full range was in question as it makes almost no sense at all to leave two /32 in there, especially the .0.0 which is the net address and should never been seen anyway for that range.