I'd like to use iptraf-ng to see how much data my machine is sending/receiving from the Internet, but I want to exclude traffic on my LAN as I am only interested in data going off-site.I have created a filter as follows, but when I activate it, iptraf-ng shows no traffic at all!Source IP address: 192.168.0.0Source wildcard mask: 255.255.255.255Destination IP address: 192.168.0.0Destination wildcard mask: 255.255.255.255Protocols: All IP, TCP, UDP, ICMP (actual values set or unset make no difference)Include/exclude: E (if I change it to I there is no difference)Match opposite: N (if I change it to Y there is no difference)This is making me think either the filters are completely broken, or I am really misunderstanding how they work.How should I create an iptraf-ng filter that excludes all traffic where both the source and destination IPs are in 192.168.0.0/24?
How to exclude LAN traffic with iptraf-ng?
networking;bandwidth
Two things should be noted:Match opposite does not mean reverse the sense of the filter. What it means is Match both incoming and outgoing traffic for the hosts/ports in the filter.Once a filter is in place, any packet that doesn't match the filter is discarded. So if you use an exclusion filter, it's important to complete it with an accept all rule, otherwise nothing is matched!With that in mind, the way to define a filter to exclude LAN is:Create a filter, give it a name. When you get to the screen for adding filter, add the following:IP address: 192.168.0.0Wildcard mask: 255.255.0.0Skip the port range and the destination IP/wildcard/portPut Y in All IPPut E in Include/ExcludePut Y in Match oppositePress enter to add this rule to the filter, then a to add another rule:Skip all address fieldsPut Y in All IPPut I in Include/ExcludePut N in Match oppositeThis one is the allow all rule. Press enter to accept it.Back in the filter screen, press x to exit. Select Apply filter... from the menu and apply the new filter you have created.You now have a filter that accept everything - except traffic coming or going from the LAN.(In my case, I used it to filter port 22, as I was connecting to the machine I wanted to check via ssh, and the iptraf output itself was causing most of the traffic because it was going through ssh).