[Snort-users] re: tcpdump expression

Roelof JT Jonkman roel at ...155...
Fri Nov 9 20:29:02 EST 2001


Greg,

Looks like there is a bug in the recent version of pcap, and the
interpretation of the CIDR mask is broken, I checked an authoritive
book on the subject, and it clearly states this is valid cidr addressing.

Apparently this was working in older versions of libpcap.

CIDR is documented in RFC 1812 
http://www.rfc-editor.org/rfc/rfc1812.txt


			roel




More information about the Snort-users mailing list