topic Re: Can you Exclude an address from your traffic search? in General Topics

Can you Exclude an address from your traffic search?

DanTheMan — Wed, 11 Mar 2020 17:01:03 GMT

the following search string
( app eq dns ) and ( port.dst eq 53 ) and ( addr.dst in 8.8.8.8 )

searches and displays all dns traffic using port 53 that has the destination ip of 8.8.8.8

I would like to know if I can look at all dns traffic traveling on port 53 except the traffic going to 8.8.8.8

atluri4b8 — Wed, 11 Mar 2020 17:22:57 GMT

In the filter, you can modify it as ( app eq dns ) and ( port.dst eq 53 ) and ( addr.dst notin 8.8.8.8 ).

This helps in filtering the dns traffic excluding the traffic going to 8.8.8.8.

Hope this helps.

hshawn — Wed, 11 Mar 2020 18:02:26 GMT

adding to what @atluri4b8 already said you can also use a bang

!(addr.dst in 8.8.8.8) will exclude 8.8.8.8