Hello, is it possible to ignore certain subnet communication?
My setup:
LAN is 192.168.69.0/24 and 192.168.70.0/24
I want to capture traffic which only leaves and enters my net from/to outside interwebs, ie ignore ALL traffic inside LAN (like NFS between 192.168.69.2 and .69.4)
I feel like it will be something like 'not src net 192.168.69.0/24 and not dst net 192.168.69.0/24', but that does not work - trisul does not start with
UPD: replaced and with or and 'compiled' BPF with -ddd. Works. Solved.

Appreciate the update.

With RXRING modes, you need the BPF codes via tcpdump -ddd. I suppose we could work that in to the codebase but this works.

Cheers !