ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Short ipv4 addresses in filter

From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
Date: Fri, 3 Jun 2011 21:54:19 +0200
Hi,

Any reason why display filter don't accept e.g. ip.addr == 10.0/8 ?

I track it down to get_host_ipaddr():
#v+
    if (!inet_aton(host, &ipaddr)) {
 		/* ... */
	} else {
		/* Does the string really contain dotted-quad IP?
		 * Check against inet_atons that accept strings such as
		 * "130.230" as valid addresses and try to convert them
		 * to some form of a classful (host.net) notation.
		 */
		unsigned int a0, a1, a2, a3;
		if (sscanf(host, "%u.%u.%u.%u", &a0, &a1, &a2, &a3) != 4)
			return FALSE;
	}
#v-

But this comment doesn't help with understanding why short forms are rejected.
Maybe portability issues? AFAIR windows inet_aton() doesn't accept such forms...

Cheers.