<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
First off, to write a CIDR address correctly you need to use something of the form w.x.y.z/M</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Your specification is missing the ".z" prtion of the ip address.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think there is also some confusion regarding how netmasks work.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The ip address 192.168.128.0 (I assume you want a .0 at the end) written in binary is 11000000.10101000.10000000.00000000</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The /17 subnet mask written in binary is 11111111.11111111.10000000.00000000</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If we perform a binary AND of these two addresses we get 11000000.10101000.10000000.000000 written in decimal is 192.168.128.0</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This means that the FIRST address of this range is 192.168.128.0</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If we perform the binary NOT of the subnet mask we get 00000000.00000000.01111111.11111111</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
When we take the binary OR of this with the IP address (w.x.y.z) we get 11000000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the last address if the range.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.168.255.255</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I hope that helps.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature" class="elementToProof">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(153, 153, 153);">
--</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(153, 153, 153);">
Evan</div>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of brian hoffman <brianhoffman@yahoo.com><br>
<b>Sent:</b> October 14, 2024 11:27 AM<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] netmask filter issue</span>
<div> </div>
</div>
<table align="left" style="direction: ltr; text-indent: revert; line-height: revert; white-space: revert; background-color: revert; display: table; margin: revert; width: 100%; height: revert; table-layout: fixed; color: revert; border-collapse: collapse; border-spacing: 0px; box-sizing: border-box;">
<tbody>
<tr style="background-color: revert;">
<td style="direction: ltr; text-indent: revert; line-height: revert; white-space: revert; border-width: revert; border-style: revert; border-color: revert; background-color: rgb(166, 166, 166); padding: 7px 2px; word-break: revert; color: revert; width: 0px; height: revert;">
</td>
<td style="direction: ltr; text-align: left; text-indent: revert; line-height: revert; white-space: revert; border-width: revert; border-style: revert; border-color: revert; background-color: rgb(234, 234, 234); padding: 7px 5px 7px 15px; word-break: revert; color: rgb(33, 33, 33); width: 100%; height: revert;">
<div style="direction: ltr; text-align: left; text-indent: revert; line-height: revert; white-space: revert; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; color: revert;">
<span style="letter-spacing: revert; background-color: revert; line-height: revert;">You don't often get email from brianhoffman@yahoo.com.
<a href="https://aka.ms/LearnAboutSenderIdentification" data-auth="NotApplicable" style="color: revert; display: revert; background-color: revert;" id="OWAdc785467-8ffd-05ec-48b8-9f3b271561ae" class="OWAAutoLink">
Learn why this is important</a></span></div>
</td>
<td align="left" style="direction: ltr; text-indent: revert; line-height: revert; white-space: revert; border-width: revert; border-style: revert; border-color: revert; background-color: rgb(234, 234, 234); padding: 7px 5px; word-break: revert; color: rgb(33, 33, 33); width: 75px; height: revert;">
</td>
</tr>
</tbody>
</table>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
I set up a filter to send certain messages matching an IP range to a destination (a simplified version of my actual config).</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
filter f_siem {</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
netmask(192.168.128/17) or</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
};</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
<br>
</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
<span style="color: rgb(0, 0, 0);">For some reason this is picking up the address 192.168.63.41, even though it's not in the range.
</span>192.168.63.41 (10101100.00010111.0) does not match the network portion of 192.168.128.0/17 (10101100.00010111.1) but for some reason it's still getting picked up. I know for sure that it is this particular line because when I comment it out the messages
are no longer forwarded for that device.</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
<br>
</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
Is there something different about the way this netmask directive works in syslog-ng that would cause it to get matched by this filter?</div>
<div style="direction: ltr; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 18px;">
-Brian</div>
</body>
</html>