Thanks for the response. I just compiled version v.1.1.1 (r7153). I believe I am using pcap. I installed by svn checkout, configure, make, make install. The OS is Ubuntu 12.04.3 LTS x86 (32bit).
Here is my config file: # egrep -v '^#|^$' /etc/ntopng/ntopng.conf -U ntop --daemon -w 3000 --data-dir /etc/ntopng/data --httpdocs-dir /usr/local/share/ntopng/httpdocs --scripts-dir /usr/local/share/ntopng/scripts --callbacks-dir /usr/local/share/ntopng/scripts/callbacks --redis localhost:6379 -i eth0 -G=/var/run/ntopng/ntopng.pid -m "10.100.253.0/24" -B "ip and not multicast and not (src net 10.100.253.0/24 and dst net 10.100.253.0/24)" Despite specifying the filter, I see traffic between hosts on network 10.100.253.0/24 and multicast in the ntopng web interface. The goal is to only have ntopng report on external connections. Thanks, Joe On Wed, Jan 8, 2014 at 5:30 AM, Filippo Fontanelli <[email protected]> wrote: > Joe > > I tested your BPF filter and it works as expected for me using the latest > ntopng code in SVN. > > Please check your ntopng backend, are you using pf_ring or pcap? > > Can you provide more information about your issue? > > Best regards, > Filippo > > On 07 Jan 2014, at 20:39, Joe Rizzo <[email protected]> wrote: > >> Hi - >> I am running ntopng (i686 v.1.1.1 (r7147)). I want to apply the >> following filter however it has no effect on ntopng reporting. >> >> -B "ip and not multicast and not (src net 10.100.253.0/24 and dst >> net 10.100.253.0/24)" >> >> This filter works as expected with tcpdump. >> >> What am I missing? >> >> Thanks, >> Joe >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
