Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Subject: Specifying a single host (was:RE: [snort] Snort 1.7 projected fea tures)
From: Mullen, Patrick (Patrick.MullenGD-CS.COM)
Date: Fri Mar 31 2000 - 10:33:42 CST
- Next message: Martin Roesch: "[snort] On the road...."
- Previous message: Andrew R. Baker: "RE: [snort] Snort 1.7 projected features"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
> Do we currently allow standalone host IP addresses? (ie 192.168.1.1)
> I thought that they all needed to have a /32 appended. If we do allow
> them then I need to rework my idea for parsing them. Here is
> my idea for
> parsing the address portion. I would propose using the
> following three
You've been able to have a single host specified without
the /32 netmask for a while now. It was a mod I made to
rules.c so people could be lazy in SPP and beyond (I use
the rules.c IP address parser in SPP).
Check out rules.c ParseIP() to see how it's done now.
In essence, it breaks the specified IP into two tokens,
separated by a '/'. If it only succeeds in getting one
token (i.e. no '/' was in the string), it assumes it is
a single host and assigns the /32 netmask.