[Snort-users] re: tcpdump expression
Roelof JT Jonkman
roel at ...155...
Fri Nov 9 20:29:02 EST 2001
Looks like there is a bug in the recent version of pcap, and the
interpretation of the CIDR mask is broken, I checked an authoritive
book on the subject, and it clearly states this is valid cidr addressing.
Apparently this was working in older versions of libpcap.
CIDR is documented in RFC 1812
More information about the Snort-users