so the correct filter for your simple case is !(host 192.168.10.2 or (vlan and host 192.168.10.2)) and the correct filter for your more-complex case is !(host 192.168.10.2 or host 192.168.0.3 or port 161 or (vlan and (host 192.168.10.2 or host 192.168.0.3 or port 161))) > Yep, that works. Thanks for your help.