[Ntop] BPF Filters

[Seth Art]

Thanks Burton.  That did it!!  

On Thu, 10 Mar 2005 12:16:38 -0600, Burton Strauss
<Burton at ntopsupport.com> wrote:
> Return to your boolean logic text book - not associates w the closest
> object...
> 
>     not (src net A/24 and dst net B/24) or (src net B/24 and dst net A/24)
> 
> Is really
> 
>     (not (src net A/24 and dst net B/24)) or (src net B/24 and dst net A/24)
> 
> Or just
> 
>     not (src net A/24 and dst net B/24)
> 
> With that filter, you'll still see B->A, just not A->B
> 
> How about:
> 
>     not ((src net A/24 and dst net B/24) or (src net B/24 and dst net A/24))
> 
       not ((src net A/24 and dst net B/24) or (src net B/24 and dst net A/24))
> ??
> 
> -----Burton
> 
> 
> -----Original Message-----
> From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf Of Seth
> Art
> Sent: Thursday, March 10, 2005 10:07 AM
> To: ntop at Unipi.IT
> Subject: [Ntop] BPF Filters
> 
> I have a BPF related question.  How do i ignore all packets going between
> subnet a and subnet B but but not lose either A or B's traffic going to
> subnets c, d, e, etc.
> 
> (Subnet A and B are both VLAN's in my office and I only want to see what is
> going into our frame relay cloud).  A and B just route across the router but
> never get pushed into the cloud.
> 
> not (src net A/24 and dst net B/24) or (src net B/24 and dst net A/24)
> 
> Can you even use parenthesis in BPF's?  NTOP accepts i still see
> A<-->B traffic in NTOP.   Thanks for the help.
> 
> -Seth
> _______________________________________________
> Ntop mailing list
> Ntop at unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
> 
> _______________________________________________
> Ntop mailing list
> Ntop at unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>