Re: [WinPcap-users] error in net/mask windump specification

[Guy Harris <guy () alum mit edu>]

Alex Narinsky wrote:
> > From the Cisco tutorial (http://www.cisco.com/warp/public/701/3.html)
> the net mask combination "172.16.50.1 255.255.255.0" is valid.
>
> However, when I apply this combination to windump - 
> windump "net 172.16.50.1 mask 255.255.255.0"
>
> I am getting the error:
> windump: non-network bits set in "172.16.50.1 mask 255.255.255.0"
>
> Why windump rejects this net/mask?

Because WinPcap does.

> By the way tcpdump works in the same way.

Because libpcap does.  (See "gen_mcode()".)

I *presume* the idea is to warn people if they get the network address 
or netmask wrong, so that one of the bits in the network address is part 
of the host part rather than the network part.  Perhaps that's an 
excessively cautious check, and should be removed, and it should just 
strip off the host-part bits in the network address when generating the 
code.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.