Re: prefix len confusion

On Wed, 10 Jun 2026, at 7:20 AM, Reindl Harald wrote:
> Am 10.06.26 um 03:01 schrieb Randy Bush:
>>>> essentially, i am seeing the traditional ssh dict attcak to
>>>> 42.642.11.82, when i think i am filtering 42.642.11.80/30, which should
>>>> cover 42.642.11.82
>>>
>> sorry for being insufficiently explicit
>> 
>> the ssh attacker is getting through to 42.642.11.82, which is a piece of
>> hardware, not a vm.  it is the ssh port of a hardware switch whose
>> security profile i prefer not to expose to attackers.
>> 
>>      define VULN4 = {
>> 	42.642.11.34/31,
>> 	42.642.11.36/31,
>> 	42.642.11.40/29,
>> 	42.642.11.48/29,
>> 	42.642.11.80/30   # <<<====
>>      }
> you guys realize that "642" can't be part of an ipv4 address
> and "should cover" is best answered with ipcalc
> in that case it says the input is nonsense

This is not the flex that you think it is.

Firstly, it is (obviously) a comment intended to draw attention to the entry, not a diagnostic message. Secondly, had the ruleset not been (obviously) obfuscated, nft would hardly wait until encountering that particular entry before electing to complain about an invalid address.

--
Kerin Millar