With some more experimenting this morning I found the answer:
For internal private traffic:
flow where Destination IP Address = 10.0.0.0/8 or Destination IP Address = 172.16.0.0/12 or Destination IP Address = 192.168.0.0/16
For Internet bound traffic it looks like:
flow where Destination IP Address != 10.0.0.0/8 and Destination IP Address != 172.16.0.0/12 and Destination IP Address != 192.168.0.0/16
This will result also in showing multicast traffic. But that could then be filtered in like fashion or kept as needed.
..and now I know.
1 person found this helpful
For Internet flows, would following query be more easier?
flow where Flow Type = 'Destination is Internet'
flow where Flow Type = 'Switched' or Flow Type = 'Routed'