<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<HTML
><HEAD
><TITLE
>Filters</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.64
"><LINK
REL="HOME"
TITLE="IPTraf User's Manual"
HREF="manual.html"><LINK
REL="PREVIOUS"
TITLE="Additional Information"
HREF="morelanmoninfo.html"><LINK
REL="NEXT"
TITLE="UDP Filters"
HREF="udpfilters.html"></HEAD
><BODY
CLASS="CHAPTER"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>IPTraf User's Manual</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="morelanmoninfo.html"
>&#60;&#60;&#60; Previous</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="udpfilters.html"
>Next &#62;&#62;&#62;</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="CHAPTER"
><H1
><A
NAME="FILTERS"
>Filters</A
></H1
><P
>  Filters are used to control the information displayed by the
  IP traffic monitor, general and
  detailed interface statistics, and TCP/UDP statistical
  breakdown. You may want to view statistics only on particular traffic,
  so you must restrict the information displayed. The filters also apply
  to logging activity.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The filters affect the IP traffic monitor, the general and
  detailed interface statistics, and the TCP/UDP service monitor. The
  packet size breakdown and LAN station monitor are not affected.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  The IPTraf filter management system is accessible through the
  <I
CLASS="EMPHASIS"
>Filters...</I
> submenu.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN1245"
></A
><P
><IMG
SRC="iptraf-filtermenu.png"></P
><P
><B
>Figure 1. The Filters submenu</B
></P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="TCPFILTERS"
>TCP Filters</A
></H1
><P
>  The <I
CLASS="EMPHASIS"
>Filters/TCP...</I
> main menu option
  allows you to define a set of parameters that determine what TCP traffic
  to pass to the monitors. Selecting this option pops up another menu with
  the tasks used to define and apply custom TCP filters.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN1252"
></A
><P
><IMG
SRC="iptraf-tcpfltmenu.png"></P
><P
><B
>Figure 2. The TCP filter menu</B
></P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1255"
>Defining a New Filter</A
></H2
><P
>  A freshly installed program will have no filters defined, so
  before anything else, you will have to define a filter. You can do this
  by selecting the <I
CLASS="EMPHASIS"
>Define new filter...</I
> option.</P
><P
>  Selecting this option displays a box asking you to enter a short
  description of the filter you are going to define. Just enter any text
  that clearly identifies the nature of the filter.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN1260"
></A
><P
><IMG
SRC="iptraf-tcpflt-dlg1.png"></P
><P
><B
>Figure 3. The TCP filter name dialog</B
></P
></DIV
><P
>  Press Enter when you're done with that box. As an alternative, you can
  also press Ctrl+X to cancel the operation. Following that will
  be another dialog box asking you for the source and target IP addresses,
  wildcard masks, and service ports.</P
><P
>  You can enter addresses of individual hosts, networks,
  or a catch-all address. The nature of the address will be determined
  by the wildcard mask.</P
><P
>  You'll notice two sets of fields. You fill these out
  with the information about your source and targets. Strictly speaking,
  because packets alone don't provide information about which
  side initiated the connection (except for SYN packets), you may think of
  these as "endpoint" fields rather than as strict
  source/destination fields. That
  means you can enter information about the "from" side in the first set
  of fields, and the "to" side in the second set, or vice versa.
  It doesn't matter, each filter entry will match packets flowing in the
  reverse direction.</P
><P
>  Fill out the IP address of the hosts or networks in the first field
  marked <TT
CLASS="COMPUTEROUTPUT"
>Host name/IP Address</TT
>. Enter it in
  standard dotted- decimal notation. When done, press Tab to move to the
  Wildcard mask field. The wildcard mask
  is similar but not exactly identical to the standard IP subnet
  masks. The wildcard mask is used to determine which bits to ignore
  when processing the filter. In most cases, it will work very closely
  like a subnet mask. Place ones (1) under the bits you want the filter to
  recognize, and keep zeros (0) under the bits you want the filter
  to ignore. For example:</P
><P
>To recognize the host 207.0.115.44</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1269"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
>IP address</TD
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>207.0.115.44</TT
></TD
></TR
><TR
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>To recognize all hosts belonging to network
202.47.132.<TT
CLASS="REPLACEABLE"
><I
>x</I
></TT
></P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1284"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
>IP address</TD
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>202.47.132.0</TT
></TD
></TR
><TR
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.0</TT
></TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>To recognize all hosts with any address:</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1298"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
>IP address</TD
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="50%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  The IP address/wildcard mask mechanism of the display filter doesn't
  recognize IP address class. It uses a simple bit- pattern matching
  algorithm.</P
><P
>  The wildcard mask also does not have to end on a
  byte boundary; you may mask right into a byte itself. For example,
  255.255.255.224 masks 27 bits (255 is 11111111, 224 is 11100000 in
  binary).</P
><P
>  Leaving the wildcard mask fields blank or storing invalid data in them
  causes the filter to recognize the entries as 255.255.255.255.</P
><P
>  IPTraf also accepts host names in place of the IP addresses. IPTraf will
  resolve the host name when the filter is loaded. When the filter
  is interpreted, the wildcard mask will also be applied. This can be
  useful in cases where a single host name may resolve to several IP
  addresses.</P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
> See the <I
CLASS="EMPHASIS"
>Linux Network Administrator's Guide</I
>
  if you need more information on IP addresses and subnet masking.</P
></TD
></TR
></TABLE
></DIV
><P
>  The <TT
CLASS="COMPUTEROUTPUT"
>Port</TT
> fields should contain a port number of the service you may be
  interested in. Leave it at 0 to let the filter ignore it. You will
  most likely be interested in target ports rather than source ports
  (which are usually unpredictable anyway, perhaps with the exception
  of FTP data).</P
><P
>  Fill out the second set of fields with the parameters of the
  opposite end of the connection. As previously mentioned, you may place
  either set of parameters in either set of fields. By default, the second
  set of parameters are preset to 0.0.0.0, 0.0.0.0, 0. Just Backspace or
  Delete over them and replace them if needed.</P
><P
>  The last field is marked <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude</TT
>.
  This field allows you to decide whether to include or exclude matching
  packets from the display. Setting this field to <TT
CLASS="COMPUTEROUTPUT"
>I</TT
> causes the filter to
  display matching entries, while setting it to <TT
CLASS="COMPUTEROUTPUT"
>E</TT
> causes the filter to
  suppress the display of matching entries. This field is set to
  <TT
CLASS="COMPUTEROUTPUT"
>I</TT
> by default.</P
><P
>  Press Enter to accept all parameters when done. The parameters will be
  accepted and you'll be presented with another blank form. You can enter
  as many sets of parameters as you wish. Press Ctrl+X at a blank form
  when done.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN1328"
></A
><P
><IMG
SRC="iptraf-tcpflt-dlg2.png"></P
><P
><B
>Figure 4. The TCP filter parameters dialog</B
></P
></DIV
><DIV
CLASS="SECT3"
><H3
CLASS="SECT3"
><A
NAME="AEN1331"
>Examples</A
></H3
><P
>To see all traffic to/from host 202.47.132.1 from/to 207.0.115.44, regardless of TCP port </P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1334"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>202.47.132.2</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>207.0.115.44</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>To see all traffic from/to host 207.0.115.44 to/from all hosts
on network 202.47.132.x</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1363"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>207.0.115.44</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>202.47.132.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  To see all Web traffic, regardless of source or destination</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1392"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>80</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  To see all mail (SMTP) traffic to a single host (202.47.132.2) from anywhere </P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1421"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>202.47.132.2</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>25</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  To see traffic to/from host sunsite.unc.edu from/to cebu.mozcom.com</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1450"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>sunsite.unc.edu</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>cebu.mozcom.com</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  To omit display of traffic to/from 140.66.5.x from/to anywhere</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1479"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>140.66.5.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  In all the above examples, you could have interchanged the first and
  second sets of IP addresses, wildcard masks, and port values; they
  wouldn't have made any difference. That's why they're better referred to
  as "first" and "second" rather than "source" and "target".</P
><P
>  You can enter as many parameters as you wish. All of them will
  be interpreted when the filter is processed.</P
></DIV
><DIV
CLASS="SECT3"
><H3
CLASS="SECT3"
><A
NAME="AEN1509"
>Excluding Certain Sites</A
></H3
><P
>&#13;  Filters follow an "implicit no-display" policy, that is, only explicitly
  defined sites will be displayed, everything else is not. This is similar
  to the access-list policy "whatever is not explicitly permitted is
  denied". If you want to show all traffic to/from everywhere,
  except certain places, you can specify the sites you wish to exclude,
  mark them with <TT
CLASS="COMPUTEROUTPUT"
>E</TT
> in the <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude
field</TT
>, and
  define a general catch-all entry with source address
<TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>, mask
  <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>, port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>, and destination
<TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>, mask <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>,
port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>, tagged
  with an <TT
CLASS="COMPUTEROUTPUT"
>I</TT
>
in the <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude</TT
> field as the last entry.</P
><P
>  For example:</P
><P
>To see all traffic except all SMTP, Web, and traffic from/to 207.0.115.44</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1524"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>25</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>&nbsp;</TD
><TD
>&nbsp;</TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
> 0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>80</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>&nbsp;</TD
><TD
>&nbsp;</TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>207.0.115.44</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>&nbsp;</TD
><TD
>&nbsp;</TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  To omit all TCP from the display, define a filter with a single
  entry, with a source of <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
> mask
<TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
> port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>, and a destination
  of <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
> mask <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>
port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>,
with the <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude</TT
> field
  marked <TT
CLASS="COMPUTEROUTPUT"
>E</TT
> (exclude). Then apply this filter.</P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1635"
>Applying a Filter</A
></H2
><P
>  The above steps only add the filter to a defined list. To actually apply
  the filter, you must select <I
CLASS="EMPHASIS"
>Apply filter...</I
> from the menu. You will be
  presented with a list of filters you already defined. Select the one you
  want to apply, and press Enter.</P
><P
>  The applied filter stays in effect over exits and restarts of the IPTraf program until it is detached.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1640"
>Editing a Defined Filter</A
></H2
><P
>  Select <I
CLASS="EMPHASIS"
>Edit filter...</I
> to modify an existing filter. Once you select this
  option, you will be presented with the list of defined filters.
  Select the filter you want to edit by moving the selection bar and press
  Enter.</P
><P
>  Edit the description if you wish. Pressing Ctrl+X at this point
  will abort the operation, and the filter will remain unmodified. Press
  Enter to accept any changes to the filter description.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN1645"
></A
><P
><IMG
SRC="iptraf-editfilter.png"></P
><P
><B
>Figure 5. The filter parameters selection screen.  Selecting an entry
displays that set for editing</B
></P
></DIV
><P
>  After pressing Enter, you will see the filter's rules. To edit an
  existing filter rule, move the selection bar
  to the desired entry and press Enter. A prefilled dialog box
  will appear. Edit its contents as desired. Press Enter to accept the
  changes or Ctrl+X to discard.</P
><P
>  You can add a new filter rule by pressing I to insert at the selection
  bar's current position. When you press I, you will be presented with a
  dialog box asking you to enter the new rule data. Pressing A results
  in a similar operation, except the rule will be appended as the
  last entry in the rule list.</P
><P
>  Pressing D deletes the currently pointed entry.</P
><P
>  Press X or Ctrl+X to end the edit and save the changes.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>If you're editing the currently applied filter, you will need
  to re-apply the filter for the changes to take effect.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Be aware that the filter process the rules in order. In other
  words, if a packet matches more than one rule, only the first matching
  rule is followed.</P
></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1658"
>Deleting a Defined Filter</A
></H2
><P
>  Select <I
CLASS="EMPHASIS"
>Delete filter...</I
> from the menu to remove a filter
  from the list. Just move the selection bar to the filter you want to
  delete, and press Enter.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1662"
>Detaching a Filter</A
></H2
><P
>  The <I
CLASS="EMPHASIS"
>Detach filter</I
> option deactivates the filter currently in
  use. Selecting this option causes all TCP traffic to be passed
  to the monitors.</P
><P
>  When you're done with the menu, just select the Exit menu option.</P
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="morelanmoninfo.html"
>&#60;&#60;&#60; Previous</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="manual.html"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="udpfilters.html"
>Next &#62;&#62;&#62;</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Additional Information</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>UDP Filters</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>