Wildcard hardware address syntax

[Simon Hobson]

HAWKER, Dan wrote:

># Class to match vmware MAC addresses
>class "vmware" {
>	match if substring (hardware,1 ,5) = 00:0c:29;
>	}

Have you tried substring (hardware,1 ,3) ?

5 bytes is never going to match 3 bytes ! You also start at byte 1 
(the second byte) and byte 0 is the hardware type.

Simon