I am trying to monitor traffic to a specific server but the sensor does not show any traffic. I have tried the following channel filters (and a few others) without success:
#2001:Server (DestinationIP[192.168.1.1]) OR (SourceIP[192.168.1.1])
and
#2001:Server ((Protocol[TCP] OR Protocol[UDP]) AND (DestinationIP[192.168.1.1] OR SourceIP[192.168.1.1]))
I have configured other channels but this is the first I've tried that filters by IP address.
Is here something I've missed that's needed to get this to work ?
Add comment