Re: Exclude one IP

[Joel Esler <joel.esler () sourcefire com>]

If you want to totally exclude it from analyzation, use a BPF filter  
at the command line, "not host 10.1.10.24"

If you want to exclude it from the HOME_NET

var HOME_NET [10.1.10.0/24,!10.1.10.24]

That should work for you..

Joel


On Nov 1, 2005, at 9:48 AM, John Friedman wrote:

> Hi all,
>
> I want to exclude one IP from monitoring segment.  I did
> var HOME_NET 10.1.10.0/24[not 10.1.10.24] and got an error.
>
> Anyone can point me the right one?
>
> Thanks,
>
> John
>
> Yahoo! FareChase - Search multiple travel sites in one click.