<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:18px;"><div dir="ltr" data-setdir="false">I set up a filter to send certain messages matching an IP range to a destination (a simplified version of my actual config).</div><div dir="ltr" data-setdir="false"><div><div>filter f_siem {<br></div><div>netmask(192.168.128/17) or</div><div>};</div><div><br></div></div><div dir="ltr" data-setdir="false"><span><span style="color: rgb(0, 0, 0); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">For some reason this is picking up the address 192.168.63.41, even though it's not in the range. </span></span>192.168.63.41 (10101100.00010111.0) does not match the network portion of 192.168.128.0/17 (10101100.00010111.1) but for some reason it's still getting picked up. I know for sure that it is this particular line because when I comment it out the messages are no longer forwarded for that device.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Is there something different about the way this netmask directive works in syslog-ng that would cause it to get matched by this filter?</div><div dir="ltr" data-setdir="false">-Brian</div></div></div></body></html>