need help understanding class matching

[jeffrey j donovan]

On Aug 30, 2011, at 10:21 AM, Simon Hobson wrote:

> jeffrey j donovan wrote:
> 
>> it was a combination of the " eight " and semi colon closing the string. This line works
>> _______________________
>> 
>> class "machines" {
>>         match if   substring (hardware, 1, 8) = "00:11:af"
>>         or substring (hardware, 1, 8) = "00:11:ba"
>>         or substring (hardware, 1, 8) = "00:11:bb"
>>         or substring (hardware, 1, 8) = "00:11:bc" ;
>> }
> 
> Really ?
> The hardware field (for an ethernet network) will contain a 1 (0x01) followed by the 6 bytes of MAC address - it does not contain an ascii representation of those bytes. To fetch the OUI of the MAC address you do need to get bytes 1 to 3 of the hardware and compare with a 3 byte string.

okay not really, the syntax works but the clients are not matching.

i did see where someone did a conversion prior to the substring line. but I did not understand it;
binary-to-ascii (16, 8, "", substring (hardware, 6, 1))),2) );


im thinking this might work

ahhh,.. 
i found this
http://blather.michaelwlucas.com/archives/962

class "sip-phone" {
match if (binary-to-ascii (16,8,":",substring(hardware, 0, 4)) = "1:0:3:e3")
or (binary-to-ascii (16,8,":",substring(hardware, 0, 4)) = "1:0:3:6b")
or (binary-to-ascii (16,8,":",substring(hardware, 0, 4)) = "1:0:7:eb");
log (info, (binary-to-ascii (16,8,":",substring(hardware, 0, 4))));
}

makes sense when I see it.
-j