It is very common to use IP address filters with Profiles, for the purposes of including only IP addresses from a particular IP address, excluding the IP addresses of internal monitoring systems, and so forth. This is easily done with Urchin. However, it is important to use the proper 'Filter Field' specification when setting up an IP address filter.
The simplest way to configure the appropriate internal traffic filter is to follow these steps:
- Navigate to Configuration -> Urchin Profiles -> Filter Manager in the Urchin administration interface
- Click the "Add" button to create a new filter
- Choose "Filter out internal traffic" from the "=> Select Example Filters" dropdown menu
- Replace the example IP address in the "Filter Pattern" box with the IP address you wish to filter out. Don't forget to put a backslash ("\") character in before each dot in the IP address!
- Click "Finish" and then click "More Options" on the next window
- Select all the Profiles you want to apply the filter to in the "Available Profiles" box and then click the right arrow to transfer them to the "Applied To" box.
- Click "Update" to apply the filter to the selected Profiles
Remember that Urchin filter patterns are POSIX regular expressions. Therefore, be sure to escape the '.' characters in your IP address specification to ensure that Urchin does not interpret them as metacharacters for the regular expression. For example, to filter on the IP address '172.16.1.1', you would specify the filter pattern as '172\.16\.1\.1'. As another example, to filter on the IP address range '192.168.xxx.xxx', the filter field would be specified as '192\.168\.'.
Here are some more examples:
Note the use of $ which indicates that no other numbers should follow the last printed number. So, to include both 22.214.171.124 as well as 126.96.36.199, your filter can be written as 63\.212\.171\.5. But, to match only 63\.212\.171\.5, your filter pattern should be written as 63\.212\.171\.5$
192.168.10.10 through 192.168.10.50 can be written as
the filter pattern 63\.212\.171\.5 will also match 163\.212\.171\.5. To only include the IP that begins with a certain number, use the 'Match to the beginning of the string expression '^' like so
Complete Regular Expression List
|.||match any single character|
|*||match zero or more of the previous item|
|+||match one or more of the previous item|
|?||match zero or one of the previous item|
|()||remember contents of parenthesis as item|
|||match one item in this list|
|-||create a range in a list|
|^||match to the beginning of the field|
|$||match to the end of the field|
|\||escape any of the above|