First off, to write a CIDR address correctly you need to use something of the form w.x.y.z/M Your specification is missing the ".z" prtion of the ip address. I think there is also some confusion regarding how netmasks work. The ip address 192.168.128.0 (I assume you want a .0 at the end) written in binary is 11000000.10101000.10000000.00000000 The /17 subnet mask written in binary is 11111111.11111111.10000000.00000000 If we perform a binary AND of these two addresses we get 11000000.10101000.10000000.000000 written in decimal is 192.168.128.0 This means that the FIRST address of this range is 192.168.128.0 If we perform the binary NOT of the subnet mask we get 00000000.00000000.01111111.11111111 When we take the binary OR of this with the IP address (w.x.y.z) we get 11000000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the last address if the range. The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.168.255.255 I hope that helps. -- Evan ________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of brian hoffman <brianhoffman@yahoo.com> Sent: October 14, 2024 11:27 AM To: syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu> Subject: [syslog-ng] netmask filter issue You don't often get email from brianhoffman@yahoo.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> I set up a filter to send certain messages matching an IP range to a destination (a simplified version of my actual config). filter f_siem { netmask(192.168.128/17) or }; For some reason this is picking up the address 192.168.63.41, even though it's not in the range. 192.168.63.41 (10101100.00010111.0) does not match the network portion of 192.168.128.0/17 (10101100.00010111.1) but for some reason it's still getting picked up. I know for sure that it is this particular line because when I comment it out the messages are no longer forwarded for that device. Is there something different about the way this netmask directive works in syslog-ng that would cause it to get matched by this filter? -Brian