Re: prefix len confusion

On Wed, 10 Jun 2026, at 2:32 AM, Randy Bush wrote:
>>> sorry for being insufficiently explicit
>>>
>>> the ssh attacker is getting through to 42.642.11.82, which is a piece of
>>> hardware, not a vm.  it is the ssh port of a hardware switch whose
>>> security profile i prefer not to expose to attackers.
>>>
>>>     define VULN4 = {
>>> 	42.642.11.34/31,
>>> 	42.642.11.36/31,
>>> 	42.642.11.40/29,
>>> 	42.642.11.48/29,
>>> 	42.642.11.80/30   # <<<====
>>>     }
>>>
>>>         ip daddr $VULN4 drop
>
>> 
>> In that case, the question becomes one of whether your nftables host
>> is responsible for forwarding packets to "42.642.11.82" (as you put
>> it) at all. And, just as importantly, from which source address.
>
> the nftables is on the border router.  and traceroute showed the path
> in.
>
> the sources of the attacks are a ddos, /82 logs the ssh attack as from a
> jillion source addresses.

Probably best to trace only packets with the SYN flag set. Otherwise, the trace output could be overwhelming.

ip daddr 42.642.11.82 tcp dport 22 tcp flags syn/syn,ack meta nftrace set 1

-- 
Kerin Millar