<html><head></head><body><div class="ydpa04125e5yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:18px;"><div></div>
<div dir="ltr" data-setdir="false">Yes, you were spot on. I realized not long after I sent this that the .0 was missing on the end.</div><div dir="ltr" data-setdir="false">Thanks!</div><div dir="ltr" data-setdir="false">-Brian</div><div><br></div>
</div><div id="ydp1d3bdf1ayahoo_quoted_9327043904" class="ydp1d3bdf1ayahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div><br></div><div><div dir="ltr">Date: Tue, 15 Oct 2024 00:32:37 +0000<br></div><div dir="ltr">From: Evan Rempel <<a href="mailto:erempel@uvic.ca" rel="nofollow" target="_blank">erempel@uvic.ca</a>><br></div><div dir="ltr">To: "syslog-ng@lists.balabit.hu" <<a href="mailto:syslog-ng@lists.balabit.hu" rel="nofollow" target="_blank">syslog-ng@lists.balabit.hu</a>><br></div><div dir="ltr">Subject: Re: [syslog-ng] netmask filter issue<br></div><div dir="ltr">Message-ID:<br></div><div dir="ltr"> <<a href="mailto:YT4P288MB03355F0F965988C4C22978C0B9452@YT4P288MB0335.CANP288.PROD.OUTLOOK.COM" rel="nofollow" target="_blank">YT4P288MB03355F0F965988C4C22978C0B9452@YT4P288MB0335.CANP288.PROD.OUTLOOK.COM</a>><br></div><div dir="ltr"> <br></div><div dir="ltr">Content-Type: text/plain; charset="iso-8859-1"<br></div><div dir="ltr"><br></div><div dir="ltr">First off, to write a CIDR address correctly you need to use something of the form w.x.y.z/M<br></div><div dir="ltr">Your specification is missing the ".z" prtion of the ip address.<br></div><div dir="ltr"><br></div><div dir="ltr">I think there is also some confusion regarding how netmasks work.<br></div><div dir="ltr"><br></div><div dir="ltr">The ip address 192.168.128.0 (I assume you want a .0 at the end) written in binary is 11000000.10101000.10000000.00000000<br></div><div dir="ltr"><br></div><div dir="ltr">The /17 subnet mask written in binary is 11111111.11111111.10000000.00000000<br></div><div dir="ltr"><br></div><div dir="ltr">If we perform a binary AND of these two addresses we get 11000000.10101000.10000000.000000 written in decimal is 192.168.128.0<br></div><div dir="ltr">This means that the FIRST address of this range is 192.168.128.0<br></div><div dir="ltr"><br></div><div dir="ltr">If we perform the binary NOT of the subnet mask we get 00000000.00000000.01111111.11111111<br></div><div dir="ltr">When we take the binary OR of this with the IP address (w.x.y.z) we get 11000000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the last address if the range.<br></div><div dir="ltr"><br></div><div dir="ltr">The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.168.255.255<br></div><div dir="ltr"><br></div><div dir="ltr">I hope that helps.<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">--<br></div><div dir="ltr">Evan</div></div>
</div>
</div></body></html>