Hey all!

Real quick…trying to filter OUT firewall hits that have say…169.254.  Will this do the trick?

filter f_firewall {

        not program (firewall flags(ignore-case));

        and not message("169\.254\.[0-9]+\.[0-9]+");

};

Thanks all.

James