net net/len (0.0.0.0)

[Felipe Kellermann <stdfk () terra com br>]

I noticed 'net 0.0.0.0/0' filter compiles to a BPF code that differs from 
the alternative 'net mask' filter. All the others net filters I tried 
produced the same BPF code. Still haven't looked at the code -- is this 
resulting code known/intentional? Using pcap 0.9.4,

src net 0.0.0.0 mask 0.0.0.0:
(000) ldh      [12]
(001) jeq      #0x800           jt 4    jf 2
(002) jeq      #0x806           jt 4    jf 3
(003) jeq      #0x8035          jt 4    jf 5
(004) ret      #96
(005) ret      #0

src net 0.0.0.0/0:
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 4
(002) ld       [26]
(003) jeq      #0x0             jt 8    jf 9
(004) jeq      #0x806           jt 6    jf 5
(005) jeq      #0x8035          jt 6    jf 9
(006) ld       [28]
(007) jeq      #0x0             jt 8    jf 9
(008) ret      #96
(009) ret      #0

-- 
Felipe Kellermann
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.