Filter for multiple subnets

[ashawapfc]

 My filter is not working, can you tell me why?

((addr.src notin '172.0.0.0/8') or ( addr.src notin 10.0.0.0/8 ))      and      ((addr.src notin '180.0.0.0/8') or ( addr.src notin 100.0.0.0/8 ) or ( addr.src notin 200.0.0.0/8 ))

or for easier reading;

(NOT or NOT) and (NOT or NOT)

Basically,

I want to see all traffic that does not source from my internal, AND does not include some of our other IP's

I have tried a bunch of syntax, but when I do the ((addr.src notin '172.0.0.0/8') or ( addr.src notin 10.0.0.0/8 )) (or other stuff), it runs, and returns those subnets anyway

[Raido_Rattameister · Accepted solution]

Basically you want to exclude traffic that comes from any of those 5 subnets?

(addr.src notin '172.0.0.0/8') and ( addr.src notin 10.0.0.0/8 )  and (addr.src notin '180.0.0.0/8') and ( addr.src notin 100.0.0.0/8 ) and ( addr.src notin 200.0.0.0/8 )

or

!((addr.src in '172.0.0.0/8') and ( addr.src in 10.0.0.0/8 )  and (addr.src in '180.0.0.0/8') and ( addr.src in 100.0.0.0/8 ) and ( addr.src in 200.0.0.0/8 ))

[reaper · Accepted solution]

the syntax will be AND for all the subnets

(notin A) AND (notin B) AND (notin C) AND (notin D)

you can only have 1 subnet per source field, so normally an 'AND' between 2 subnets would create no hits as you can't have both subnets in the same field, but the use of 'not' makes the 'and' an 'or' ("not and not" makes a boolean 'or')

(notin A) AND (notin B) AND (notin C) AND (notin D)

==

!((in A) OR (in B) OR (in C) OR (in D))