[Snort-users] Maybe a bit OT...

J. Craig Woods drjung at ...2066...
Sat Feb 23 12:20:38 EST 2002


John Sage wrote:
> 
> Craig:
> 
> I think you want /16, if you want the whole block:
> 
> Address:   4.41.0.0              00000100.00101001 .00000000.00000000
> Netmask:   255.255.0.0 == 16     11111111.11111111 .00000000.00000000
> =>
> Network:   4.41.0.0/16           00000100.00101001 .00000000.00000000 (Class A)
> Broadcast: 4.41.255.255          00000100.00101001 .11111111.11111111
> HostMin:   4.41.0.1              00000100.00101001 .00000000.00000001
> HostMax:   4.41.255.254          00000100.00101001 .11111111.11111110
> Hosts/Net: 65534
> 
> (Cool tool tip: ipcalc @ http://jodies.cx/ipcalc.pl )
> 
> What about this is *not* working?
> 
> The netblock range, or something else?
>

Thanks to all that helped, especially for the very cool tool. You guys
were right, it was "4.41.0.0/16 that I wanted to filter out. Seems it
was not doing its thing because of where I put the rule in reference to
the other ipchains rules. Just like in snort, it makes a difference. 

Thanks,
-- 
J. Craig Woods
UNIX/NT Network/System Administration

-Art is the illusion of spontaneity-




More information about the Snort-users mailing list