6

I'm using nfsen and I need to apply a filter to get specific ip range and I can't find the syntax. I searched in the doc of nfdump and tcpdump but nothing.

For now the netflows captured provides from multiples address and the ip range I want to get (and only those address) is from 130.190.0.0 to 130.190.127.255 with a mask /17

Or another way to explain this, I only want adress that start by 130.190 I don't care about other like 216.58, 51.254...etc there are a lot more

Improve this question
7
  • Did you mean 130.190.0.0 to 130.190.127.255? That would be the /17 block.
    – ilkkachu
    Commented May 16, 2017 at 13:09
  • @ilkkachu yes that's right, the /17 is the mask of my network
    – klaypez
    Commented May 16, 2017 at 13:15
  • What is the range you are wanting to capture? By the way your question is worded it looks to me like all of 130.190.0.0/17 (why is your range so big, by the way?)
    – cutrightjm
    Commented May 16, 2017 at 13:20
  • I want to capture all the flows which concerns ip address starting by 130.190.X.X this is what I want. The problem is when I enter net 130.190.0.0/17 as filter, it still captures adress like 216.58.198.46 but I don't want them
    – klaypez
    Commented May 16, 2017 at 13:24
  • You may want to specify src net or dst net as appropriate.
    – Ferenc Wágner
    Commented May 17, 2017 at 9:14

1 Answer 1

Reset to default
11

If you want a filter to capture on packets mathing 130.190.0.0/17:

tcpdump net 130.190.0.0/17
Improve this answer
5
  • yeah already tried this but this filter capture other ip address like 216.58.198.46 and I don't know why
    – klaypez
    Commented May 16, 2017 at 13:29
  • 1
    It will capture 216.58.198.46 if the other end (ie. source or destination) is in 130.190.0.0/17. If you want to only catch packets where the source and destination are in 130.190.0.0/17: tcpdump src net 130.190.0.0/17 and dst net 130.190.0.0/17
    – slass100
    Commented May 17, 2017 at 14:06
  • @slass100 thanks for responding I tried the command you gave me and I only get 2 flows ? Could you explain me why please ? 2017-05-17 23:34:58.547 0.000 any 130.190.64.115 1(100.0) 1(100.0) 1028(100.0) 0 0 1028 2017-05-17 23:34:58.547 0.000 any 130.190.65.254 1(100.0) 1(100.0) 1028(100.0) 0 0 1028
    – klaypez
    Commented May 18, 2017 at 9:44
  • Without a diagram of your network, I can only guess. If your system running nfsen is connected to a switch (vs. a hub or span port) it will only "see" packets to or from your system (not packets between 2 hosts connected to the same switch as your device).
    – slass100
    Commented May 19, 2017 at 12:19
  • Hm I guess you don't understand because my english is poor sorry about that but no matters if my machine is connected to a switch or a hub no ? I just want a filter that display machine which has their IP starting byt 130.190 from source or destination. I don't know, maybe I'm looking for something doesn't exist, maybe just no filter who does what I want
    – klaypez
    Commented May 19, 2017 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .