Re: [WinPcap-users] filetring ip ranges

Sun, 31 Aug 2003 23:56:45 +0000

Thank you Daniel. It is helpful information.

From: "Daniel" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: <[EMAIL PROTECTED]>
Subject: Re: [WinPcap-users] filetring ip ranges
Date: Sat, 30 Aug 2003 19:10:43 +0100

Filtering from 192.168.1.1 - 192.168.1.15 could be done (I think) like
this:

You convert your starting range and finishing range to long ips (use
inet_addr): 
192.168.1.1 becomes: 16885952
192.168.1.15 becomes: 251766976

When compiling the filter you pass this string "(ip[12:4] >= 16885952) and
(ip[12:4] <= 16885952)".
I could have made a mistake somewhere but you can figure out I hope.

ip[12:4] accesses the source IP address in the IP header. If you want to
filter destination IP addresses,
you access the 16th byte, so ip[16:4]. The 4 in the [12:4] means IP
version 4 (or 4 bytes per addr). For IPv6, it would be
different story...

Hope it helps,
Daniel

  ----- Original Message -----
  From: Nitesh Gupta
  To: [EMAIL PROTECTED]
  Sent: Saturday, August 30, 2003 3:14 AM
  Subject: Re: [WinPcap-users] filetring ip ranges


Hi

I posted the same question some time ago but could't get a reply. An
answer to this question could be very helpful to me too. 

  Thanks,
  Nitesh

  winpcap <[EMAIL PROTECTED]> wrote:
    Hi all.

    I have tried to make the bpf filter accept port ranges,
    like 192.168.1.1 - 192.168.1.15, but i cant get it to work,
    nor can i find examples on this, or how it could be done.

    I checked the manual's for tcp dump, but i didnt find anything
    usefull. (But maybe i read that like the devil reads the bible ?)

    I hope someone can give me an example on how to do this.
    Have a nice weekend all.

/Regards J. Thomsen



------------------------------------------------------------------------------ 

  Do you Yahoo!?
  Yahoo! SiteBuilder - Free, easy-to-use web site design software

_________________________________________________________________
증권 정보 가장 빠르고 편하게 보실 수 있습니다. MSN 증권/투자 http://www.msn.co.kr/stock/ 



==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/[EMAIL PROTECTED]/

To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================

Reply via email to