table.Where(g=> g.Srcintf != "port1")
         .GroupBy(p=> p.Srcmac)
         .Select(f=> f.First());

select p1.srcmac, from_itime(p1.itime), p1.srcip, p1.user, p1.srcintf,
       p1.srcssid
       FROM $log p1
       INNER JOIN
       (
         SELECT max(from_itime(itime)) MaxPostDate, srcmac
         FROM $log
         where ( ( lower(`srcintf`) != lower('port1')))
         GROUP BY srcmac
       ) p2
       ON p1.srcmac = p2.srcmac
          AND from_itime(p1.itime) = p2.MaxPostDate
          WHERE ( ( lower(p1.srcintf) != lower('port1')))
       order by from_itime(p1.itime) desc