I have rules like this in my IPTABLES:

-A INPUT -s -j LOG --log-level 7

and I wrote a script that grabs the output of these rules and outputs the bytes from the IP to my server.

I was hoping to get suggestions on how I could create a rules that tracks ip traffic from dispersant subnets. The ip address aren't fixed and even the subnets aren't fixed. For example: could be the ip address of the device one day and could be the ip address of the same device the next day.

I think that if there was a way to write the rule so that it gave me the ip address of everything except a range of ip address that are fixed, like then I would be ok.

Something like:

-A INPUT -s NOT EQUAL -j LOG --log-level 7

Thanks in advance

2 Answers 2


Did you want (watch the !):

iptables -A INPUT ! -s -j LOG --log-level 7

This will match everything with source address NOT

From man iptables

   [!] -s, --source address[/mask][,...]
          Source specification. Address can be either a  network  name,  a
          hostname,  a  network  IP  address  (with  /mask), or a plain IP
          address. Hostnames will be resolved once only, before  the  rule
          is  submitted  to  the  kernel.  Please note that specifying any
          name to be resolved with a remote query such as DNS is a  really
          bad idea.  The mask can be either a network mask or a plain num‐
          ber, specifying the number of 1's at the left side of  the  net‐
          work  mask.   Thus, a mask of 24 is equivalent to

Here starts the relevant part:

          A "!" argument before  the  address  specification  inverts  the
          sense  of  the  address.  The  flag  --src  is an alias for this
          option.  Multiple addresses can  be  specified,  but  this  will
          expand  to  multiple  rules (when adding with -A), or will cause
          multiple rules to be deleted (with -D).
  • Thanks, can you do the ! statement for a range of address too?
    – rahrahruby
    Jan 8, 2013 at 23:28
  • Yes. Just write the rule, and ! will negate it (so all IPs except those in range).
    – mulaz
    Jan 8, 2013 at 23:30
  • for example ( etc
    – rahrahruby
    Jan 8, 2013 at 23:31
  • 1
    Intrapositioned negation is deprecated (meaning the ! after an option switch. The way to go is " ... -A INPUT ! -s 166.100. ..." Jan 8, 2013 at 23:34
  • 1
    @KarmaFusebox edited the -s ! -> ! -s
    – mulaz
    Jan 8, 2013 at 23:44

You may find that building a chain here will make things a lot easier to work with.

A chain is basically like a sub-table. You send stuff to it, and then you can either return or process things within that chain.

# return stuff, that we don't want to handle
# log everything that hasn't been returned
-A LOGME -j LOG --log-level 7

Another option, might be to create and use an ipset, which basically lets you build a set of addresses, which you can then reference in a rule using the --match-set option.

  • can I do something like, ipset -N test host host and then negate the ipset in the rule ?
    – rahrahruby
    Jan 9, 2013 at 18:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .