netmask filter issue
brian hoffman <[email protected]> Mon, 14 Oct 2024 18:27:21 +0000 (UTC)
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <[email protected]> |
--===============0353503158462788489==
Content-Type: multipart/alternative;
boundary="----=_Part_1696489_2013255311.1728930441635"
------=_Part_1696489_2013255311.1728930441635
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
I set up a filter to send certain messages matching an IP range to a destin=
ation (a simplified version of my actual config).filter f_siem {
netmask(192.168.128/17) or};
For some reason this is picking up the address 192.168.63.41, even though i=
t's not in the range.=C2=A0192.168.63.41 (10101100.00010111.0) does not mat=
ch the network portion of 192.168.128.0/17 (10101100.00010111.1) but for so=
me reason it's still getting picked up.=C2=A0 I know for sure that it is th=
is particular line because when I comment it out the messages are no longer=
forwarded for that device.
Is there something different about the way this netmask directive works in =
syslog-ng that would cause it to get matched by this filter?-Brian
------=_Part_1696489_2013255311.1728930441635
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html><head></head><body><div class=3D"yahoo-style-wrap" style=3D"font-fami=
ly:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:18px;"><div dir=
=3D"ltr" data-setdir=3D"false">I set up a filter to send certain messages m=
atching an IP range to a destination (a simplified version of my actual con=
fig).</div><div dir=3D"ltr" data-setdir=3D"false"><div><div>filter f_siem {=
<br></div><div>netmask(192.168.128/17) or</div><div>};</div><div><br></div>=
</div><div dir=3D"ltr" data-setdir=3D"false"><span><span style=3D"color: rg=
b(0, 0, 0); font-family: "Helvetica Neue", Helvetica, Arial, sans=
-serif; font-size: 18px;">For some reason this is picking up the address 19=
2.168.63.41, even though it's not in the range. </span></span>192.168.=
63.41 (10101100.00010111.0) does not match the network portion of 192.168.1=
28.0/17 (10101100.00010111.1) but for some reason it's still getting picked=
up. I know for sure that it is this particular line because when I c=
omment it out the messages are no longer forwarded for that device.</div><d=
iv dir=3D"ltr" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=
=3D"false">Is there something different about the way this netmask directiv=
e works in syslog-ng that would cause it to get matched by this filter?</di=
v><div dir=3D"ltr" data-setdir=3D"false">-Brian</div></div></div></body></h=
tml>
------=_Part_1696489_2013255311.1728930441635--
--===============0353503158462788489==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
--===============0353503158462788489==--