need help understanding class matching

[jeffrey j donovan]

On Aug 30, 2011, at 12:09 PM, Simon Hobson wrote:

> jeffrey j donovan wrote:
> 
>> > Really ?
>>> The hardware field (for an ethernet network) will contain a 1 (0x01) followed by the 6 bytes of MAC address - it does not contain an ascii representation of those bytes. To fetch the OUI of the MAC address you do need to get bytes 1 to 3 of the hardware and compare with a 3 byte string.
>> 
>> okay not really, the syntax works but the clients are not matching.
> 
> That's what I thought
> 
>> i did see where someone did a conversion prior to the substring line. but I did not understand it;
>> binary-to-ascii (16, 8, "", substring (hardware, 6, 1))),2) );
>> 
>> 
>> im thinking this might work
>> 
>> ahhh,..
>> i found this
>> http://blather.michaelwlucas.com/archives/962
>> 
>> class "sip-phone" {
>> match if (binary-to-ascii (16,8,":",substring(hardware, 0, 4)) = "1:0:3:e3")
>> or (binary-to-ascii (16,8,":",substring(hardware, 0, 4)) = "1:0:3:6b")
>> or (binary-to-ascii (16,8,":",substring(hardware, 0, 4)) = "1:0:7:eb");
>> log (info, (binary-to-ascii (16,8,":",substring(hardware, 0, 4))));
>> }
>> 
>> makes sense when I see it.
> 
> You do **NOT** have to do this. You can if you wish, but it is not necessary.
> 
> binary-to-ascii does what it says, and with the options specified will convert the binary hardware address to a string representation. Then you can match against a string.
> 
> However, you can save some typing, and processing time*, by just specifying the match strings as the binary string you want to match against.
> * When a packet comes in, you have to do the binary to ascii conversion, for each packet and for each time it's used in a class match.
> 
> so you can do :
> binary-to-ascii (16,8,":",substring(hardware, 1, 3)) = "0:11:ba3"
> or you can so :
> substring(hardware, 1, 3) = "\x00\x11\xba"
> 
> and I think (someone correct me if I'm wrong) you can write that latter one as (note the lack of quotes) :
> substring(hardware, 1, 3) = 00:11:ba
> 

Thanks for your clarification , it really helps me understand my options.
This code is working for me.  I was getting confused on delimiters and basic counting. The machines are now matching.
class "machines" {
		match if substring (hardware, 1,3) = 00:11:af
 		 or substring (hardware, 1,3) = 00:25:bc
		 or substring (hardware, 1,3) = 00:26:4a
		 or substring (hardware, 1,3) = 04:0c:ce
		 or substring (hardware, 1,3) = 04:1e:64
		 or substring (hardware, 1,3) = e8:06:88
		 or substring (hardware, 1,3) = f0:b4:79
		 or substring (hardware, 1,3) = f8:1e:df;
}

-j