<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
Hi,<br><br>I already tried this. But maybe I didn't do it the way I was supposed to. Where should I put the bpf expression ? I tried with the command line, and also with the -b option, with a bpf file, like said here : https://redmine.openinfosecfoundation.org/issues/277<br>Both didn't work.<br><br>Thank.<br>A.<br><br><div>> Date: Mon, 22 Aug 2011 18:15:11 +0200<br>> From: rmkml@yahoo.fr<br>> To: amrith@hotmail.fr<br>> CC: oisf-users@openinfosecfoundation.org; rmkml@yahoo.fr<br>> Subject: Re: [Oisf-users] Suricata / only public trafic<br>> <br>> Hi Amrith,<br>> bpf_filter like:<br>> http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-March/000522.html<br>> Regards<br>> Rmkml<br>> <br>> <br>> On Mon, 22 Aug 2011, Amrith Z wrote:<br>> <br>> > Hi all,<br>> > <br>> > I'm a sys admin, and I’m looking for a way to configure Suricata to only alert when the source or the destination corresponds to a public IP, and not regarding trafic from my internal network.<br>> > Is there a way to do that ?<br>> > <br>> > Thanks.<br>> > <br>> ><br></div> </div></body>
</html>