re: tcpdump expression

[Roelof JT Jonkman <roel () silicondefense com>]

Greg,

Looks like there is a bug in the recent version of pcap, and the
interpretation of the CIDR mask is broken, I checked an authoritive
book on the subject, and it clearly states this is valid cidr addressing.

Apparently this was working in older versions of libpcap.

CIDR is documented in RFC 1812 
http://www.rfc-editor.org/rfc/rfc1812.txt


                        roel

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users