How do I match multiple IP addresses?

Modified on Fri, 17 Nov 2023 at 10:46 AM

Here is an example of how the eval module can perform arbitrary boolean logic for this.

Check multi-filtering in versions 4.0+. Multiifiltering is the ability to match an enumerated value against many filters. It will be the best method to achieve what you are describing.

You can also try out the eval module which can perform arbitrary boolean logic, allowing you to achieve a similar results with the following:

tag=$IPFIX_KIT lpfix src dst | 
eval src==toIP("66.249.79.124") || 
src==toIP("168.212.226.204") || 
dst==toIP("66.249.79.124") || 
dst==toIP("168.212.226.204")