need help understanding class matching

[Simon Hobson]

jeffrey j donovan wrote:

>it was a combination of the " eight " and semi colon closing the 
>string. This line works
>_______________________
>
>class "machines" {
>          match if   substring (hardware, 1, 8) = "00:11:af"
>          or substring (hardware, 1, 8) = "00:11:ba"
>          or substring (hardware, 1, 8) = "00:11:bb"
>          or substring (hardware, 1, 8) = "00:11:bc" ;
>}

Really ?
The hardware field (for an ethernet network) will contain a 1 (0x01) 
followed by the 6 bytes of MAC address - it does not contain an ascii 
representation of those bytes. To fetch the OUI of the MAC address 
you do need to get bytes 1 to 3 of the hardware and compare with a 3 
byte string.

-- 
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.