Re: syslog-ng Digest, Vol 234, Issue 4
brian hoffman <[email protected]> Tue, 15 Oct 2024 12:23:39 +0000 (UTC)
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <[email protected]> |
--===============5668328846235745995== Content-Type: multipart/alternative; boundary="----=_Part_1999071_955226887.1728995019104" ------=_Part_1999071_955226887.1728995019104 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Yes, you were spot on.=C2=A0 I realized not long after I sent this that th= e .0 was missing on the end.Thanks!-Brian =20 Date: Tue, 15 Oct 2024 00:32:37 +0000 From: Evan Rempel <[email protected]> To: "[email protected]" <[email protected]> Subject: Re: [syslog-ng] netmask filter issue Message-ID: =C2=A0=C2=A0=C2=A0 <[email protected]= NP288.PROD.OUTLOOK.COM> =C2=A0=C2=A0=C2=A0=20 Content-Type: text/plain; charset=3D"iso-8859-1" First off, to write a CIDR address correctly you need to use something of t= he form w.x.y.z/M Your specification is missing the ".z" prtion of the ip address. I think there is also some confusion regarding how netmasks work. The ip address 192.168.128.0 (I assume you want a .0 at the end) written in= binary is 11000000.10101000.10000000.00000000 The /17 subnet mask written in binary is=C2=A0 11111111.11111111.10000000.0= 0000000 If we perform a binary AND of these two addresses we get=C2=A0 11000000.101= 01000.10000000.000000 written in decimal is 192.168.128.0 This means that the FIRST address of this range is 192.168.128.0 If we perform the binary NOT of the subnet mask we get 00000000.00000000.01= 111111.11111111 When we take the binary OR of this with the IP address (w.x.y.z) we get 110= 00000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the = last address if the range. The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.168.= 255.255 I hope that helps. -- Evan =20 ------=_Part_1999071_955226887.1728995019104 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div class=3D"ydpa04125e5yahoo-style-wrap" style= =3D"font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:18px= ;"><div></div> <div dir=3D"ltr" data-setdir=3D"false">Yes, you were spot on. = I realized not long after I sent this that the .0 was missing on the end.<= /div><div dir=3D"ltr" data-setdir=3D"false">Thanks!</div><div dir=3D"ltr" d= ata-setdir=3D"false">-Brian</div><div><br></div> =20 </div><div id=3D"ydp1d3bdf1ayahoo_quoted_9327043904" class=3D"ydp1d= 3bdf1ayahoo_quoted"> <div style=3D"font-family:'Helvetica Neue', Helvetica, Arial, s= ans-serif;font-size:13px;color:#26282a;"> =20 <div><br></div><div><div dir=3D"ltr">Date: Tue, 15 Oct 2024= 00:32:37 +0000<br></div><div dir=3D"ltr">From: Evan Rempel <<a href=3D"= mailto:[email protected]" rel=3D"nofollow" target=3D"_blank">[email protected]<= /a>><br></div><div dir=3D"ltr">To: "[email protected]" <<a h= ref=3D"mailto:[email protected]" rel=3D"nofollow" target=3D"_blank= ">[email protected]</a>><br></div><div dir=3D"ltr">Subject: Re:= [syslog-ng] netmask filter issue<br></div><div dir=3D"ltr">Message-ID:<br>= </div><div dir=3D"ltr"> <<a href=3D"mailto:YT4P288MB03= 355F0F965988C4C22978C0B9452@YT4P288MB0335.CANP288.PROD.OUTLOOK.COM" rel=3D"= nofollow" target=3D"_blank">YT4P288MB03355F0F965988C4C22978C0B9452@YT4P288M= B0335.CANP288.PROD.OUTLOOK.COM</a>><br></div><div dir=3D"ltr"> &nbs= p; <br></div><div dir=3D"ltr">Content-Type: text/plain; charset=3D"is= o-8859-1"<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">First off, t= o write a CIDR address correctly you need to use something of the form w.x.= y.z/M<br></div><div dir=3D"ltr">Your specification is missing the ".z" prti= on of the ip address.<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">= I think there is also some confusion regarding how netmasks work.<br></div>= <div dir=3D"ltr"><br></div><div dir=3D"ltr">The ip address 192.168.128.0 (I= assume you want a .0 at the end) written in binary is 11000000.10101000.10= 000000.00000000<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">The /1= 7 subnet mask written in binary is 11111111.11111111.10000000.0000000= 0<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">If we perform a bina= ry AND of these two addresses we get 11000000.10101000.10000000.00000= 0 written in decimal is 192.168.128.0<br></div><div dir=3D"ltr">This means = that the FIRST address of this range is 192.168.128.0<br></div><div dir=3D"= ltr"><br></div><div dir=3D"ltr">If we perform the binary NOT of the subnet = mask we get 00000000.00000000.01111111.11111111<br></div><div dir=3D"ltr">W= hen we take the binary OR of this with the IP address (w.x.y.z) we get 1100= 0000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the l= ast address if the range.<br></div><div dir=3D"ltr"><br></div><div dir=3D"l= tr">The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.= 168.255.255<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">I hope tha= t helps.<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr"><br></div><di= v dir=3D"ltr"><br></div><div dir=3D"ltr">--<br></div><div dir=3D"ltr">Evan<= /div></div> </div> </div></body></html> ------=_Part_1999071_955226887.1728995019104-- --===============5668328846235745995== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============5668328846235745995==--