Re: net net/len (0.0.0.0)

[Felipe Kellermann <stdfk () terra com br>]

On Sun, 28 May 2006 2:19am  -0300, Felipe Kellermann wrote:

> On Sun, 28 May 2006 12:26am  -0300, Felipe Kellermann wrote:
>
> > I noticed 'net 0.0.0.0/0' filter compiles to a BPF code that differs from 
> > the alternative 'net mask' filter. All the others net filters I tried 
> > produced the same BPF code. Still haven't looked at the code -- is this 
> > resulting code known/intentional? Using pcap 0.9.4,
> >
> > src net 0.0.0.0 mask 0.0.0.0:
> > (000) ldh      [12]
> > (001) jeq      #0x800           jt 4    jf 2
> > (002) jeq      #0x806           jt 4    jf 3
> > (003) jeq      #0x8035          jt 4    jf 5
> > (004) ret      #96
> > (005) ret      #0

Just noticed that on a MacOSX/ppc (10.3.9) I get consistent results using 
both net/len and net/mask. On an OpenBSD/i386, OpenBSD/SPARC, Linux/i386 
and Linux/mipsel the resulting BPF codes differ.

-- 
Felipe Kellermann
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.