Correct audit field for a netmask?
Hello,
I was wondering what was the correct way to send a netmask in an audit
message? Can I simply add it to the end of the 'addr' field:
addr=10.0.0.0/8
Or is there some other field specifically for the netmask?
addr=10.0.0.0 X=8
--
paul moore
linux security @ hp