is there a burt on ifconfig for fedora11?

[Bill Davidsen]

Sharpe, Sam J wrote:
> 2009/7/26 Craig White <craigwhite at azapple.com>:
>> On Sun, 2009-07-26 at 18:32 +0100, Sharpe, Sam J wrote:
>>> 2009/7/26 Sarkar, Kaushik <Kaushik.Sarkar at netapp.com>:
>>>> Don’t know from where ifconfig getting netmask as 255.255.0.0 when I set it
>>>> for 255.255.255.0
>>>>
>>> I do...
>>>
>>>> root at kaushik_Fedora11 /> cat /etc/sysconfig/network-scripts/ifcfg-eth0
>>> <snip>
>>>> NETMASK=255.225.255.0
>>> Read that very very carefully... ;o)
>>>
>>> I think because 255.225.255.0 is not a valid netmask, it's defaulting
>>> to 255.255.0.0
>>>
>>> (aren't a second pair of eyes wonderful!)
>> ----
>> it's a valid netmask but it is one that is highly unlikely to work
>> because it appears to have a typo
> 
> No it isn't a valid netmask - that was my point - perhaps I should
> have been clearer about the fact it has a typo and that's why it
> wouldn't work.
> 
> A valid netmask is a set of 1s, followed by a set of 0s. The posted
> netmask (with assumed typo) is:
> 
> 11111111111000011111111100000000
> 
> That does not fit the definition of a netmask and it certainly can't
> be mapped to a prefix, because the Prefix is calculated by the the
> number of preceding 1s!
> 
This sounds as if you are reversing the prefix and netmask definitions. A 
netmask is anded with two IP addresses before they are compared, a prefix is as 
you describe.

Consider:
   iptables -A FORWARD -p tcp -s 10.5.12.0/255.255.252.192 -j ACCEPT

This relates to a CIDR block in 10.5.x.x where any packet coming from a server 
(/24 IP ending 0..63) is accepted, packets from user machines are not. Thus user 
machines do not have the same capabilities as servers, and users think they are 
in a /24 subnet talking to their own servers.

Try this to verify it's valid:
   iptables -A INPUT -p tcp -s 192.168.12.0/255.255.252.192 \
     -j LOG --log-level debug --log-prefix "servr: "
   iptables -L INPUT -nv

If you are about to make the point that this is a special use case, I agree, and 
I'm sure in his case the 225 was a finger-check, agreed there. But netmask can 
be useful in some cases where multiple rules would otherwise be needed.

-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot