Re: prefix len confusion

Am 10.06.26 um 03:01 schrieb Randy Bush:
>>> essentially, i am seeing the traditional ssh dict attcak to
>>> 42.642.11.82, when i think i am filtering 42.642.11.80/30, which should
>>> cover 42.642.11.82
>>
> sorry for being insufficiently explicit
> 
> the ssh attacker is getting through to 42.642.11.82, which is a piece of
> hardware, not a vm.  it is the ssh port of a hardware switch whose
> security profile i prefer not to expose to attackers.
> 
>      define VULN4 = {
> 	42.642.11.34/31,
> 	42.642.11.36/31,
> 	42.642.11.40/29,
> 	42.642.11.48/29,
> 	42.642.11.80/30   # <<<====
>      }
you guys realize that "642" can't be part of an ipv4 address
and "should cover" is best answered with ipcalc
in that case it says the input is nonsense

[harry@srv-rhsoft:/downloads]$ ipcalc 42.642.11.80/30
ipcalc: bad IPv4 address: 42.642.11.80

if it's meant as obscurity that's not really helpful after a breach