Citation :
2 -B --filter-expression Filters allows the user to restrict the traffic seen by ntop on just about any imaginable item.
The filter expression is set at run time by this parameter, but it may be changed during the ntop run on the Admin | Change Filter web page.
The basic format is -B filter , where the quotes are REQUIRED
The syntax of the filter expression uses the same BPF (Berkeley Packet Filter) expressions used by other packages such as tcpdump
For instance, suppose you are interested only in the traffic generated/received by the host jake.unipi.it. ntop can then be started with the following filter:
ntop -B src host jake.unipi.it or dst host jake.unipi.it
or in shorthand:
ntop -B host jake.unipi.it or host jake.unipi.it
See the 'expression' section of the tcpdump man page - usually available at http://www.tcpdump.org/tcpdump_man.html - for further information and the best quick guide to BPF filters currently available.
WARNING: If you are using complex filter expressions, especially those with =s or meaningful spaces in them, be sure and use the long option format, --filter-expression="xxxx" and not -B "xxxx".
|
