|
Hi Daniel.
Thanks for the answer.
I have been playing with it some, and now i think i have found and error in the bpf logic or parser. Here are my finding. Offcause i might be doing
the
following wrong, but please correct me if so. Since i have taken it home to play with here, i
will
use other ip's as in my first email. A : 10.0.0.10 = 167772170
B : 10.0.0.12 = 167772172 This should capture only trafic originating
from
A or B. This works as supposed to. ( ip [12:4] = A or ip [12:4] = B )
This should capture any trafic originating from
any
address starting at A and ending at B, including both A and B and any addresses in between, like 10.0.0.11 here. ( ip [12:4] >= A and ip [12:4] <= B
)
But it doesnt work. It captures only trafic from
A.
Rewriting it like this doesnt help, still doesnt work. ( ( ip [12:4] >= A ) and ( ip [12:4] <= B )
)
As a test, i negated it to see what happens. And it
negates
the error, and captures anything but A. To try and find out if it is the "equal" to signs
that i have
wrong, i tried again like this: ( ( ip [12:4] > A-1 ) and ( ip [12:4] < B+1 )
)
The error is still there, and this is where my
logic stops :/
I also found a mail from the archives describing the same problem: Hopefully someone can confirm if i am doing this
wrong, or if this is really
a bug in the bpf system. Regards,
J. Thomsen From: Daniel
|
