After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other traffic not web related.
running tcpdump/windump I can do this simply tcpdump -w notwww.pcap not 192.168.4.4 not port 80 not port 443
But I cannot find documentation or a location to put this in the config.