Wireshark-dev: [Wireshark-dev] About the netmask (Was:Wireshark-commits: [Wireshark-commits] re
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 07 Jul 2010 07:39:14 +0200
From: guy@xxxxxxxxxxxxx
Date: Wed, 07 Jul 2010 01:55:39 GMT

http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=33461

User: guy
Date: 2010/07/06 06:55 PM

Log:
 I added PCAP_NETMASK_UNKNOWN in libpcap 1.1.0; it's not present in
 1.0.0.  You're supposed to just use 0 in releases prior to 1.1.0 - in
 1.1.0 and later, a netmask of PCAP_NETMASK_UNKNOWN will cause errors if
 you try to use "ip broadcast" (as you need the netmask to check for
 local broadcasts), but, prior to that, the netmask value is blindly used
 even if the filter will always fail.



Guy, first of all thanks for fixing this.

When working on this parameter I was wondering what was happening here.

What if I have an interface with:
1. untagged 192.168.16.0/24
2. tagged 10.0.0.0/28
and have a filter 'ip broadcast or vlan and ip broadcast'.

Or even worse, what if I have an interface with:
1. tagged 192.168.16.0/24
2. tagged 10.0.0.0/28
and have a filter 'vlan and ip broadcast'.
If I understand it correctly either case will only partially match when setting up the netmask parameter to either /24 or /28. 

Thanks,
Jaap

PS: Holland, Holland!!! ;)