Thanks Seth. A slightly different question: how do I ignore traffic between hosts in a particular subnet? I want to ignore all chatter between machines in my cluster, and simply examine traffic between the cluster and the world. Mat