Is there any way to utilize the negative (not) switches in the FlowViewer (or grapher or monitor) form fields? I want to do something like, anything sourced from subnet_A and NOT destined to subnet_B.
Thanks for any info,
Tim
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi,
SiLK's rwfilter command supports both positive & negative partitioning switches, eg:
[{--daddress=IP_WILDCARD | --not-daddress=IP_WILDCARD}]
Is there any way to utilize the negative (not) switches in the FlowViewer (or grapher or monitor) form fields? I want to do something like, anything sourced from subnet_A and NOT destined to subnet_B.
Thanks for any info,
Tim