Hello All,
I know we can sniff multiple ports with “tool sniffer quick ports=3389,443” and we can exclude a port with “tool sniffer quick ports=!3389” but what if I want to exclude multiple ports?
I tried "“tool sniffer quick ports=!3389,!443” but it displays all ports including the ones I’m trying to exclude. I think the logic is !3389 displays all ports including 443, and !443 displays all ports including 3389.
Is there a way to exclude multiple ports?
Thanks so much!
Did you also try !3389,443 ?
Yes, that shows all ports besides 3389. It does show port 443 and it does show all other ports as well.
Ok then I guess it is impossible to do it this way.
Of course you can still use the sniff actions in the IP firewall mangle tables to send whatever traffic you like to an external sniffer machine.
On ROS 7.19.2, this works:
/tool/sniffer/quick mac-protocol=!802.2,!capsman operator-between-entries=and
Notice the operator-between-entries that you can set to either and or or.