From owner-freebsd-net@FreeBSD.ORG  Sun Mar  8 11:01:00 2015
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 87673A97
 for <freebsd-net@freebsd.org>; Sun,  8 Mar 2015 11:01:00 +0000 (UTC)
Received: from mail-ig0-x235.google.com (mail-ig0-x235.google.com
 [IPv6:2607:f8b0:4001:c05::235])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 4BCBFE21
 for <freebsd-net@freebsd.org>; Sun,  8 Mar 2015 11:01:00 +0000 (UTC)
Received: by igbhn18 with SMTP id hn18so14061924igb.2
 for <freebsd-net@freebsd.org>; Sun, 08 Mar 2015 04:00:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=berentweb.com; s=google;
 h=date:from:cc:subject:message-id:in-reply-to:references:mime-version
 :content-type:content-transfer-encoding;
 bh=7wkIfDoBNxSjytJ6g6m4VicQ0rK1VWN3hCD/mvmhiZM=;
 b=X5Ufeg4ormRtxrF+TDxERD+gfYYoT6pdtfZ7YTCeHfnxHbCAZbIj8Pvr5FaqhXz8Yc
 0Mybn9xBumQx/ot76gT9E3j6ccT39doxxQ2kqmDXwx9RNU0+Vfn7iyLALlL4fihLRTS4
 7HOhKA7MpnRUoNCYOMC+qLa0iPg7nkiVhMmZM=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=x-gm-message-state:date:from:cc:subject:message-id:in-reply-to
 :references:mime-version:content-type:content-transfer-encoding;
 bh=7wkIfDoBNxSjytJ6g6m4VicQ0rK1VWN3hCD/mvmhiZM=;
 b=PBBj4xm5I06AH5Cf05Nq3EInHjaDQURHXFlspGBfP6nSS6Oa/J1lK10R1QP4TpMUWC
 jhynoeBUhXCxrr60/nzzkDXzudG1K5p14GbIlqNUQdVy3B3Gof2oGscqFBICgCUpKib+
 tDAXYf1VNjsXYu1BFjStt7oajthy5i5hlRHT8DG5oshQzkXz6chdtAEGK3DPmFYqeTj7
 FwqwCLY1vADl+kGdERbNfsqycGPayOAZF5OLqZpeXVVkWTz5CFhAFcJrWw1Sfu+KyHkF
 yuoYjOiKw1nUESbPaewgpj3vF6eqcKhzfgmcZr3wJSVRmSw41PV2bGyCLKsyIVvF0r50
 Li6Q==
X-Gm-Message-State: ALoCoQk5M5cHHcCR+lP/L22aoBbUXoPL3CXH7clXWyxhMtYJKGWfWv8gPl+vk6JC3pm45hGOFK2x
X-Received: by 10.107.163.65 with SMTP id m62mr3844931ioe.40.1425812459006;
 Sun, 08 Mar 2015 04:00:59 -0700 (PDT)
Received: from rsbsd.rsb ([31.200.10.254])
 by mx.google.com with ESMTPSA id 192sm10341448ioo.38.2015.03.08.04.00.49
 for <freebsd-net@freebsd.org>
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
 Sun, 08 Mar 2015 04:00:58 -0700 (PDT)
Date: Sun, 8 Mar 2015 12:42:32 +0200
From: Beeblebrox <zaphod@berentweb.com>
Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>
Subject: Re: tcpdump filter not ignoring jail subnet
Message-ID: <20150308124232.1c3e453d@rsbsd.rsb>
In-Reply-To: <20150306090919.0d221096@rsbsd.rsb>
References: <20150305202050.24042973@rsbsd.rsb>
 <CAN6yY1uQdSgUTvSeYqUJZr=FUGBUtCvgpB4RpfEWsF52epS2hQ@mail.gmail.com>
 <20150306090919.0d221096@rsbsd.rsb>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 08 Mar 2015 11:01:00 -0000

I got out of my logic-loop and solved my filter problem.
Thanks everyone for thier input.

((src net not 192.168.1.0/24 and host not 192.168.2.97 and not ip6) or
host mybsd) and not port (imap or imaps or 6667)

Below syntax is not accepted by tcpdump, btw:
src not (net 192.168.1.0/24 and host 192.1-----)
tcpdump does not seem to accept other keyword between "not" and the variabl=
e.

Regards.