Ethereal-users: RE: [Ethereal-users] IP ranges on capture filters?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "King, John (Greg) (LMIT-HOU)" <Greg.King@xxxxxxxx>
Date: Mon, 17 Apr 2006 09:47:30 -0500
Thanks for the information. I did not have the aggregate tool on my
system and that tool looks rather usefull. I ended up finding the rpm
via debian but then it requires some other dependency as well. Instead
of compiling for RedHat I went another route which is why I am posting
in case anyone else using Redhat/Fedora/CentOS etc looks for a similar
tool.

I ended up using Net::CIDR 

And  a simple piece of perl code

#!/usr/bin/perl -T
# aggregate.pl
# usage ./aggregate.pl 192.168.1.50-192.168.1.200

use strict;
use Net::CIDR;
if ($ARGV[0] =~ /^\d+\.\d+\.\d+\.\d+\-\d+\.\d+\.\d+\.\d+\b/) {
#never trust input from the outside
        print join("\n", Net::CIDR::range2cidr($ARGV[0])) . "\n";
#input was in proper format so print
} else { print "Data for range is not in an acceptable format.\n"; }

-Greg 

> -----Original Message-----
> From: ethereal-users-bounces@xxxxxxxxxxxx 
> [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Andrew Hood
> Sent: Monday, April 17, 2006 7:28 AM
> To: Ethereal user support
> Subject: Re: [Ethereal-users] IP ranges on capture filters?
> 
> King, John (Greg) (LMIT-HOU) wrote:
> > Is there a way to tell tethereal to capture data for an ip range say
> > 192.168.1.50-100 without having to create a huge filter with many
> > entries? Currently I am covering the capture range like this:
> > 
> > Tethereal -I eth1 -b 200 -a filesize:20000 -w 'SAMPLEa' -f 
> "ip and (host
> > 192.168.1.50 or host 192.168.1.51 ...)"
> 
> : echo 192.168.1.50-192.168.1.100 | aggregate -irange
> 192.168.1.50/31
> 192.168.1.52/30
> 192.168.1.56/29
> 192.168.1.64/27
> 192.168.1.96/30
> 192.168.1.100/32
> 
> so:
> 
> tethereal -i eth1 -b 200 -a filesize:20000 -w 'SAMPLEa' -f 
> "ip and (net
> 192.168.1.50/31 or net 192.168.1.52/30 or net 192.168.1.56/29 or net
> 192.168.1.64/27 or net 192.168.1.96/30 or net 192.168.1.100/32)"
> 
> -- 
> There's no point in being grown up if you can't be childish sometimes.
>                 -- Dr. Who
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>