Did you try putting dst net parameters in brackets?

src as 1234 and (dst net 1.2.3.4/24 or dst net 2.3.4.5/24 or dst net
3.4.5.6/25)

On Sun, Aug 2, 2015 at 10:47 PM, Royke <[email protected]> wrote:

> Not like that,
>
> The case :
>
> I want to check traffic from specific AS to each specified network.
>
> Filter 1 :
> src as 1234 and dst net 1.2.3.4/24 or dst net 3.4.5.6/24 or dst net
> 4.5.6.7/24 .
>
> This will work but not as intended
> Because the filter statement from :
>
> or dst net 3.4.5.6/24 or dst net 4.5.6.7/24 will accept any src as
> beside as 1234
>
> So I should write the filter like this :
>
> Filter 2 :
> src as 1234 and dst net 1.2.3.4/24 or src as 1234 and dst net 3.4.5.6/24
> or src as 1234 and dst net 4.5.6.7/24
>
> It would be more simple if I can write the filter like :
>
> Filter 3 :
> src as 1234 and dst net in [ 1.2.3.4/24 3.4.5.6/24 4.5.6.7/24 ]
>
> That sintaks only applied to ip addresses.
>
> See that ?
>
> So right now I'm using the filter like Filter 2. It works but very long
> sintaks if you have 10 network or more.
>
> regards
>
> On 07/31/2015 08:42 PM, Saverio Proto wrote:
> > What about
> >
> > (net in net.wo.rk.a/24) or (net in net.wo.rk.b/24) or (net in
> net.wo.rk.c/24)
> >
> > this works for you ? :)
> >
> > Saverio
> >
> > 2015-07-30 8:45 GMT+02:00 Royke <[email protected]>:
> >> Hi Peter / All
> >>
> >> I want to create filter with network address as a list so I create
> >> filter like this :
> >>
> >> net in [ net.wo.rk.a/24 net.wo.rk.b/24 net.wo.rk.c/24 ], but not work.
> >> And based on the documentation is not possible.
> >> I cannot "supernet/summarize" the network to /23 or /22 since they are
> >> very different networks.
> >>
> >> Could you consider this as a feature request ?
> >> Or is it possible but not well documented ?
> >>
> >> Thank you and Best regards
> >> Royke
> >>
> >>
> ------------------------------------------------------------------------------
> >> _______________________________________________
> >> Nfsen-discuss mailing list
> >> [email protected]
> >> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

Reply via email to