Re: Proposal to apply mask to IP address set on rule

At Fri, 23 May 2025 17:05:01 -0400 (EDT), Mouse <[email protected]> wrote:
Subject: Re: Proposal to apply mask to IP address set on rule
>
> >> As is 192.168.123.0/8,
> > [...]
> >> where you probably swapped net and host len and meant /24
> > That makes no sense to me whatsoever.
>
> 192.18.123.0/24 is 24 bits of network, 8 of host.  It's easy enough to
> mentally swap those and write /8 instead, counting the host bits
> instead of the network bits.

I've almost never ever counted or considered the host bits when writing
a subnet specification, and _especially_ not ever when writing a filter
rule.

Subnets have a number of bits to represent the network address, and the
number of bits left over to specify hosts is of course then implied by
the subnet "size".  I would only ever do the subtraction to find the
number of host bits if I was critically concerned that there would be
room enough in the subnet for some expected number of hosts, but I would
probably only have to do that if I was designing a subnetting scheme.

In fact when I'm writing filter rules to block out network offenders I
typically cut&paste the address of an example remote host causing
problems, paste it into a rule, then run "jwhois" on the same address,
and finally copy the reported CIDR subnet size into the rule as well,
appending it to the address, if I want to block the whole origin subnet.

--
					Greg A. Woods <[email protected]>

Kelowna, BC     +1 250 762-7675           RoboHack <[email protected]>
Planix, Inc. <[email protected]>     Avoncote Farms <[email protected]>

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRuK6dmwVAucmRxuh9mfXG3eL/0fwUCaDDoAwAKCRBmfXG3eL/0
f5n6AJoD3ASpbZ8DQrcf86yribchw4OzKACeKPp+xi+opMPeGxiEzaizIqXMoF0=
=kYHL
-----END PGP SIGNATURE-----