topic Re: Filter for multiple subnets in General Topics

Filter for multiple subnets

ashawapfc — Sat, 09 Jun 2018 00:02:54 GMT

My filter is not working, can you tell me why?

((addr.src notin '172.0.0.0/8') or ( addr.src notin 10.0.0.0/8 )) and ((addr.src notin '180.0.0.0/8') or ( addr.src notin 100.0.0.0/8 ) or ( addr.src notin 200.0.0.0/8 ))

or for easier reading;

(NOT or NOT) and (NOT or NOT)

Basically,

I want to see all traffic that does not source from my internal, AND does not include some of our other IP's

I have tried a bunch of syntax, but when I do the ((addr.src notin '172.0.0.0/8') or ( addr.src notin 10.0.0.0/8 )) (or other stuff), it runs, and returns those subnets anyway

Re: Filter for multiple subnets

Raido_Rattameister — Sat, 09 Jun 2018 01:57:13 GMT

Basically you want to exclude traffic that comes from any of those 5 subnets?

(addr.src notin '172.0.0.0/8') and ( addr.src notin 10.0.0.0/8 ) and (addr.src notin '180.0.0.0/8') and ( addr.src notin 100.0.0.0/8 ) and ( addr.src notin 200.0.0.0/8 )

!((addr.src in '172.0.0.0/8') and ( addr.src in 10.0.0.0/8 ) and (addr.src in '180.0.0.0/8') and ( addr.src in 100.0.0.0/8 ) and ( addr.src in 200.0.0.0/8 ))

Re: Filter for multiple subnets

reaper — Mon, 11 Jun 2018 10:15:16 GMT

the syntax will be AND for all the subnets

(notin A) AND (notin B) AND (notin C) AND (notin D)

you can only have 1 subnet per source field, so normally an 'AND' between 2 subnets would create no hits as you can't have both subnets in the same field, but the use of 'not' makes the 'and' an 'or' ("not and not" makes a boolean 'or')

(notin A) AND (notin B) AND (notin C) AND (notin D)

!((in A) OR (in B) OR (in C) OR (in D))