At 02:21 PM 4/5/2003 -0800, you wrote:Sounds right - you can drop the src xxx or dst xxx and just use xxx
-B "host bozo.clown.school.edu and not net xxx.yyy.zzz.0/24"
Read up on the filter syntax in the tcpdump stuff - everything that uses libpcap has the same 'BPF' syntax.
Still reading the tcpdump material - some of it is a bit obtuse, but I've picked up a few things.
However, in the shorter term, I tried
-B "host bozo.clown.school.edu and not net xxx.yyy.zzz.0/24"
and got the following error message:
**FATAL_ERROR** Wrong filter '(host xxx.yyy.zzz.123 and not (host xxx.yyy.zzz.0/24)' (Mask syntax for networks only) on interface eth0
Whoops - my mistake. Should be ... and not (net xxx.yyy.zzz.0/24).
I mistakenly entered host, instead of net.
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
