So if I apply a filter in wireshark like ip.addr == 123.123.123.123/24,
it will match ip from 123.123.123.0 to 123.123.123.255.
Is it correct?
@Acer It should, although people generally specify subnets using the network address: ip.addr == 123.123.123.0/24.
It's also worth noting that 123.123.123.0 is the network address and 123.123.123.255 is the broadcast address, so hosts won't be able to bind to those addresses.
@Acer 子网掩码。ipv4地址是32位二进制，subnet mask表示用几个高位表示子网号，例如/24表示前三个bytes表示子网地址，而低八位用来表示主机号。
子网掩码 255.255.255.0 下的 123.123.123.123就表示123.123.123.0这个主网下的123号主机。（btw每个子网下都有两个主机号被保留）
子网掩码 255.255.255.0 下的 123.123.123.123就表示123.123.123.0这个主网下的123号主机。（btw每个子网下都有两个主机号被保留）
@Acer typo， 最后一句话里是“子网”，不是主网。。
好像有点明白了
我是要排查ip range
@Acer 这样的话，/24表示的一般是，固定高24位不变，去扫描低八位，例如 nmap -sn 192.168.2.1/24 就表示扫描 192.168.2.1 - 192.168.2.254 ..
这有个在线工具 jodies.de/ipcalc
这有个在线工具 jodies.de/ipcalc
@Acer 按理说0和255是预留的，扫描它没意义，但是我刚试了下nmap，他说扫描了256个地址，hmmm，不要在意这些细节
@Acer port number 24 at that IP address
It is not port number. It is more like IP ranges.
@Acer Not port. That's the subnet mask. 24 bits of the address is the network and the rest is the host address. So for /24, the network address is 123.123.123.0 and the host address is 123. If it was /16, it'd be 123.123.0.0 for the network. On the first one, the subnet mask would be 255.255.255.0 and the second one would be 255.255.0.0.
@justpatrick @Acer You are absolutely right. Sorry for spewing such nonsense. For some reason I saw a colon instead of a slash. Glad someone smarter than me corrected it.
@Acer The /24 is just a subnet mask, which is just used to divide the address into a network address and a host address. In this case, the network address makes up the first 24 bits (3 bytes), so 123.123.123.0.