IP Pairs
IP Pairs can be filtered using the ippair keyword. IPv4 or IPv6 addresses may be filtered using the ‘from,’ ‘to,’ or both addresses or a range of addresses.
 
Filter strings support groupings. To group options together, you must use parentheses “( )”. You may also use these keywords:
AND
OR
Valid direction arrows are ->, <-, and >-<. Each side of the pair supports a single address or a range of addresses with ranges specified with a - (hyphen). Ports are optional on each address and support single TCP/UDP/SCTP ports or port ranges.
To exclude a IP Pair group, you must use the ! character. Currently unsupported is the use of the ! character on groupings and the NOT keyword.
IP addresses may be in CIDR format, such as 192.168.1.10/24.
 
 
IPv4 address pair traffic in both directions
"filter": "ippair 10.1.16.20<->10.1.23.114"
 
 
IPv4 address pair traffic from addr1 to addr2
"filter": "ippair 10.1.16.20->10.1.23.114"
 
 
IPv4 address pair traffic to addr1 from addr2
"filter": "ippair 10.1.16.20<-10.1.23.114"
 
 
IPv4 address pair traffic in both directions with port on addr1
"filter": "ippair 10.1.16.20[tcp/80]<->10.1.23.114"
 
 
IPv4 address pair traffic in both directions with port on addr2
"filter": "ippair 10.1.16.20<->10.1.23.114[tcp/80]"
 
 
IPv4 address pair traffic in both directions with port on both addresses
"filter": "ippair 10.1.16.20[tcp/55428]<->10.1.23.114[tcp/80]"
 
 
IPv4 address pair traffic from addr1 to addr2 with port range on addr1
"filter": "ippair 10.1.16.20[tcp/80-100]->10.1.23.114"
 
 
Ipv4 address pair traffic in both directions with addr1 range with ports
"filter": "ippair 10.1.20.40-10.1.20.49[tcp/62033]<->176.32.103.205[tcp/443]"
 
 
IPv4 address range pair traffic in both directions with port ranges
"filter": "ippair 10.1.20.40-10.1.20.49[tcp/60000-62033]<->176.32.0.1-176.32.255.255[tcp/400-500]"