Hello Peter, If you need to filter out some IP addresses/network chunks from the accounting process you just need to play around the 'pcap_filter' directive (which expects a filter in the libpcap syntax, usually well-documented in the tcpdump manpage).
The 'pcap_filter' directive is applied to all captured packets (which should be what you want) and is pushed to the libpcap (which means fast because unwanted packets are discarded before they reach 'pmacctd'). The 'not host xxx.xxx.xxx.xxx' should fit your needs, however i've not been able to understand well the scenario (a basic ASCII-graph might be of help). Cheers, Paolo
