IP filter (range)

Thread view:

MF - 15 Dec 2003 23:35 GMT

I've written a simple tomcat filter that checks a space separated list of IP
addresses (taken as an argument). Now I need to make it work better. I
need to modify it to accept a range of IP addresses as well as a single IP
address. Any suggestions on the best way to work this problem?

Thanks,
-Mark

Reply to this Message

Christian Kreutzfeldt - 16 Dec 2003 10:22 GMT

> need to modify it to accept a range of IP addresses as well as a single IP
> address. Any suggestions on the best way to work this problem?

What about regular expressions? Split the list into its single entries and
check which
one fits which type of input (range or ip).

with regards,
Christian

Reply to this Message

Mark F - 16 Dec 2003 13:41 GMT

|| "MF" <mfaine@knology.net> schrieb im Newsbeitrag
|| news:vtsh9knmju1i54@corp.supernews.com...
[quoted text clipped - 7 lines]
|| with regards,
|| Christian

What I could really use is a means of determining a netmask given an IP
address.

for example 128.148.132.0/24 could be used to allow 256 hosts addresses in
the range 128.148.132.0-255, but how do determine the netmask for any three
(or four or twenty) ip addresses?

Hopefully I could then take a given IP address, compare it against a a
network IP and a subnet mask and determine if a connection should be allowed
or not.

-Mark

Reply to this Message

Gordon Beaton - 17 Dec 2003 10:20 GMT

> What I could really use is a means of determining a netmask given an
> IP address.
>
> for example 128.148.132.0/24 could be used to allow 256 hosts
> addresses in the range 128.148.132.0-255, but how do determine the
> netmask for any three (or four or twenty) ip addresses?

There is no way to exactly determine the netmask from an IP address
alone, or even from a set of IP addresses that you know belong to the
same network.

From a set of addresses you can determine the longest possible netmask
they might be using, but that's really not much better than an
educated guess. Simply determine the length of their common prefix.

/gordon

Signature

[ do not email me copies of your followups ]
g o r d o n + n e w s @ b a l d e r 1 3 . s e

Reply to this Message

Michael Amling - 17 Dec 2003 13:21 GMT

> || "MF" <mfaine@knology.net> schrieb im Newsbeitrag
> || news:vtsh9knmju1i54@corp.supernews.com...
[quoted text clipped - 18 lines]
> network IP and a subnet mask and determine if a connection should be allowed
> or not.

As a first approximation you could use the IP address's class to
determine its subnet. Originally this was
If IP address starts with binary 0, subnet mask is 8 bits (Class A).
If IP address starts with binary 10, subnet mask is 16 bits (Class B).
If IP address starts with binary 110, subnet mask is 24 bits (Class
C). See, for example, http://www.redhat.com/advice/tips/ipnetworking.html.

However, the class system has broken down, and the actual subnet
masks used are not always the defaults listed above any more.

--Mike Amling

Reply to this Message

IP filter (range)

Free Magazines