Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2527] Display filter should accept alternate IPv4 address

Date: Thu, 8 May 2008 13:29:25 -0700 (PDT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2527


Gerald Combs <gerald@xxxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID




--- Comment #7 from Gerald Combs <gerald@xxxxxxxxxxxxx>  2008-05-08 13:29:21 PDT ---
As I mentioned before, we've been using inet_aton for a *very* long time.
However, we've been enforcing dotted-quad notation since 2002:
http://www.ethereal.com/lists/ethereal-dev/200203/msg00039.html

This was to fix ambiguity when using CIDR notation. That is, if wireshark
accepted "ip.addr eq 10.20/16" as a valid display filter, inet_aton would
convert the address portion to "10.0.0.20".

IMHO, requiring dotted-quad addresses is the correct behavior in that it
removes ambiguity. According to inet_aton, "10.20" means one thing. According
to CIDR, libpcap, TCP Wrappers, /etc/networks, Apache, and Postfix it means
another. Who's right?


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.