In case of Mirrored Traffic or ZMQ Interfaces, this preference is forced to IP Address.

This is used to compute traffic direction (ingress or egress) based on the provided MAC address(es) (comma-separated list) as in some case (when capturing traffic from a traffic mirror or PCAP) it is not possible to know the traffic direction. Traffic directed to the configured MAC address(es) is considered as egress traffic.
Note:
In case no MAC address is configured, the traffic direction is set using local vs remote hosts traffic (-m).

ntopng can use a criterion to disaggregate incoming traffic. When a disaggregation criterion is selected, ntopng will use the criterion value to divert incoming traffic to dynamically-created interfaces. For example, when the 'VLAN Id' criterion is selected, a dynamic interface will be created for each VLAN Id observed, and the incoming traffic will be diverted to one dynamic interface depending the VLAN Id value.

'VLAN Id' disaggregation is supported both for physical interfaces as well as for flows received over ZMQ. The other disaggregation criteria are only supported for ZMQ flows and will be ineffective for physical interfaces.

A custom traffic disaggregation by means of BPF-like filters is also available by disabling Dynamic Traffic Disaggregation (set it to 'None') through the Custom Traffic Disaggregation tab.

Criterion changes will not affect existing interfaces. A restart of ntopng is required for the change to have effect.