Hi Everybody,
Sorry if the question is repleted but really I need a help, thanks.
Problem is that I want to filter traffic from and to some host.
The filter configuration is looking like:
cat /etc/flow-tools/cfg/filter.cfg
filter-primitive myhost
type ip-address
deny x.x.x.38
default permit
filter-definition drop_myhost
match ip-source-address myhost
or
match ip-destination-address myhost
and I start flow capture like this:
flow-capture -w /var/flow-tools -N 0 -e 1 -n 1439 -V5 -p
/var/run/flow-captur.pid -f /etc/flow-tools/cfg/filter.cfg -F
drop_myhost 0/y.y.y.1/8818 -R /etc/flow-tools/export.sh
but still I see host x.x.x.38 in flow :(
flow-cat `ls ft*` | flow-stat -f 10 -S 3 | grep x.x.x.38
x.x.x.38 216.155.193.146 1 288 4
x.x.x.38 80.85.129.25 1 152 2
x.x.x.38 89.208.43.72 1 152 2
Anything wrong in configuration?
And the flow-tools version is:
flow-tools version 0.68.1: built by [EMAIL PROTECTED] on Вск Июл 15
03:58:57 IST 2007
--
Bests,
Karen
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
