Wireshark-dev: [Wireshark-dev] About the netmask (Was:Wireshark-commits: [Wireshark-commits] re
From: Jaap Keuter <[email protected]>
Date: Wed, 07 Jul 2010 07:39:14 +0200
From: [email protected]
Date: Wed, 07 Jul 2010 01:55:39 GMT


User: guy
Date: 2010/07/06 06:55 PM

 I added PCAP_NETMASK_UNKNOWN in libpcap 1.1.0; it's not present in
 1.0.0.  You're supposed to just use 0 in releases prior to 1.1.0 - in
 1.1.0 and later, a netmask of PCAP_NETMASK_UNKNOWN will cause errors if
 you try to use "ip broadcast" (as you need the netmask to check for
 local broadcasts), but, prior to that, the netmask value is blindly used
 even if the filter will always fail.

Guy, first of all thanks for fixing this.

When working on this parameter I was wondering what was happening here.

What if I have an interface with:
1. untagged
2. tagged
and have a filter 'ip broadcast or vlan and ip broadcast'.

Or even worse, what if I have an interface with:
1. tagged
2. tagged
and have a filter 'vlan and ip broadcast'.

If I understand it correctly either case will only partially match when setting up the netmask parameter to either /24 or /28.

PS: Holland, Holland!!! ;)