topic Re: Monitor Traffic Searching for Dst Subnet in General Topics

Monitor Traffic Searching for Dst Subnet

palomed — Fri, 04 Aug 2017 17:18:49 GMT

I frequently use the ( addr.dst in 10.211.2.94 ) query type to search traffic in the Monitor tab of the PAN gui.

What if I was looking for any host in the 10.211.2.0/24 subnet? Is there way to have the equivilent of

( addr.dst in 67.211.2.0/24 ) or ( addr.dst in 67.211.2.* ) or ??

Thank you.

jvalentine — Fri, 04 Aug 2017 17:21:59 GMT

Yes, that's exactly how to do it (with the CIDR notation)

( addr.dst in 67.211.2.0/24

Did you try that in your traffic log yet? Should work just fine.

palomed — Fri, 04 Aug 2017 17:55:47 GMT

Oh jeeze - you're right I was right. 🙂

( addr.dst in 67.211.2.0/24 ) did exactly what I was hoping.