This article applies to PRTG Network Monitor 7 or 8

Filter Rules for Custom Packet Sniffing or Netflow Sensors Under PRTG Network Monitor 7 or 8

Note: To view this information for PRTG Network Monitor 9, please see PRTG 9 Manual: Filter Rules for xFlow and Packet Sniffer Sensors.

Filter rules are used for the include, exclude and channel definition fields of custom packet sniffer and netflow sensors.

Filter rules are based on the following format:

field[filter]

Valid fields are:

• IP
• Port
• SourceIP
• SourcePort
• DestinationIP
• DestinationPort
• Protocol (values: TCP, UDP, ICMP, OSPFIGP or any number)
• ToS

Additional Sniffer Fields:

• MAC
• SourceMAC
• DestinationMAC
• EtherType (values IPV4, ARP,RARP,APPLE, AARP,IPV6 ,IPXold, IPX or any number)

Additional NetFlow v5 / jFlow fields:

• Interface
• ASI
• InboundInterface
• OutboundInterface
• SourceASI
• DestinationASI

Additional NetFlow v9 fields:

• Interface
• ASI
• InboundInterface
• OutboundInterface
• SourceASI
• DestinationASI
• MAC
• SourceMAC
• DestinationMAC
• Mask
• SourceMask
• DestinationMask
  • Note: 'Masks' represent subnet masks in the form of a single number ('number of contiguous bits')
• NextHop (IP address)
• VLAN
• SourceVLAN
• DestinationVLAN
  • Note: 'VLANs' represent a VLAN identifier

Additional sFlow fields:

• Interface
• InboundInterface
• OutboundInterface
• MAC
• SourceMAC
• DestinationMAC

Data Formats:

• IP fields support wildcards (*), range (10-20) and hostmask ( /10, /255.255.0.0) syntax.
• Number fields support range (80-88) syntax.
• Protocol and EtherType fields support numbers and a list of predefined constants.

Samples:

SourceIP[10.0.0.1]
SourceIP[10.*.*.*]
SourceIP[10.0.0.0/10]
DestinationIP[10.0.0.120-130]
DestinationPort[80-88]
Protocol[UDP]

Complex expressions can be created using parentheses and and/or/not:

Protocol[TCP] and not (DestinationIP[10.0.0.1] or SourceIP[10.0.0.120-130])

See also

• How do the channel definitions for custom Packet Sniffing or xFlow (NetFlow/sFlow) sensors work?
• Which syntax can I use to define IP ranges in PRTG's probe and xFlow sensor settings?
• PRTG 9 Manual: Filter Rules for xFlow and Packet Sniffer Sensors