1. Summary of changes
`Host ignore' block contains one or more lines with IP addresses of hosts that will be ignored for counter updates.
New feature in this release is possibility to mask off groups of hosts (subnetworks) defined by corresponding network / netmask pairs. This can be useful if we wish to exclude accesses from the hosts on our campus or hosts of people developing the pages.
To accomplish this, each line in host ignore block can take two arguments. If second argument is present, first is assumed to be network address and second the netmask. If only one argument is present, it is taken as a host address or a host address with wild card.
If this concept with "network address / netmask" sounds unfamiliar, you should consult your friendly network administrator.
2. How to determine ignore hosts parameters
To configure `ignore hosts' block in configuration file, you should know at least how the network / netmask concept works. Here is a brief description.
2.1. IP Addresses and netmasks concept
IP address is a 32 bit value (four octets) that is for readability purposes written as four decimal values separated by a dot (so called dotted quad). For example, network address - in dotted quad notation
220.127.116.11is - in binary notation
10100001 00110101 00000100 00011100Binary representation is what we will need to determine network addresses and netmasks.
Each network IP address is contained of network and host part.
Generally speaking, networks are split into several classes. Here are three primary forms :
- class A network has first octet in range from 0 to 127. First octet is network address while other three octets specify the host part. In binary notation it is something like (n - network, h - host)
0nnnnnnn hhhhhhhh hhhhhhhh hhhhhhhhThere are 27 such possible networks, each with (224 - 2) hosts.
- class B network has first octet in range from 128 to 191. First two octets are the network address, and third and fourth are host address. In binary notation it is something like (n - network, h - host)
10nnnnnn nnnnnnnn hhhhhhhh hhhhhhhhThere are 214 such possible networks, each with (216 - 2) hosts.
- class C network has first octet in range from 192 to 223. First three octets are the network address, and fourth is host address. In binary notation it is something like (n - network, h - host)
110nnnnn nnnnnnnn nnnnnnnn hhhhhhhhThere are 221 such possible networks, each with (28 - 2) hosts.
Note: "-2" is because 0 is reserved for "this host", and 255 means broadcast, or "all hosts on this network".
Nothing stops us to divide the network given to us by a service provider into a several smaller networks. This is often done in real life.
Network is being partitioned by setting the 32-bit subnet mask in which 1's represent the network part, and 0's represent the host part if IP address. As of now, we may correctly assume that a default netmask for class B network is 11111111 11111111 00000000 00000000 (in binary, or 255.255.0.0 in dotted quad notation).
For example, if we are given one class C network (maximum of 254 hosts), and we want to partition it into 8 networks of 32 hosts per each subnetwork, we can do it as in the following example:
Let us assume that we are given class C network with address 18.104.22.168. Initial netmask is set to 255.255.255.0. To partition this network into 8 subnetworks, we need to take 3 bits from host part of the address (23 = 8). Let's write it in binary:
Network address 22.214.171.124:
11011100 01101001 01100101 00000000Netmask was 255.255.255.0:
11111111 11111111 11111111 00000000As we want to have 8 subnetworks (this needs 3 bits from the host part), netmask will be: 11111111 11111111 11111111 11100000 or 255.255.255.224 in dotted quad notation.
Host part of address has shrunk to 5 bits, and we will have new network address based on 25 intervals. Therefore, our new subnetworks will be:
126.96.36.199 188.8.131.52 184.108.40.206 220.127.116.11 18.104.22.168 22.214.171.124 126.96.36.199 188.8.131.52n.b. The same netmask (255.255.255.224) applies to each of the 8 networks.
From previous example can be seen that netmask cannot be set on arbitrary boundary, but rather on addresses that are powers of 2.
2.2. Configuration guidelines
As a matter of fact, it doesn't matter whether your network is class A, B or C. What matters is which subnetwork or part of the network you want to mask off.
To determine whether a certain host is within a certain network, the host's address AND netmask are compared to the network address. If they are identical, host is within the given network.
Example 1: Determine whether host 184.108.40.206 is located within the network 220.127.116.11 with netmask 255.255.255.0:
decimal binary host address 18.104.22.168 10100001 00110101 00000100 00000100 netmask 255.255.255.0 11111111 11111111 11111111 00000000 ANDed 22.214.171.124 10100001 00110101 00000100 00000000 network address 126.96.36.199 10100001 00110101 00000100 00000000
Determine whether the host 188.8.131.52 is located within the network 184.108.40.206 with netmask set to 255.255.255.224
decimal binary host address 220.127.116.11 10100001 00110101 01011011 00000111 netmask 255.255.255.224 11111111 11111111 11111111 11100000 ANDed 18.104.22.168 10100001 00110101 01011011 00000000 network address 22.214.171.124 10100001 00110101 01011011 00000000
Determine whether the host 126.96.36.199 is located within the network 188.8.131.52 with netmask set to 255.255.255.224
decimal binary host address 184.108.40.206 10100001 00110101 01011011 01100011 netmask 255.255.255.224 11111111 11111111 11111111 11100000 ANDed 220.127.116.11 10100001 00110101 01011011 01100000 network address 18.104.22.168 10100001 00110101 01011011 00000000
To set the netmask properly, and to check the configuration, you must know what addresses are being covered with certain network address / netmask combination.
Which host are located within the network 22.214.171.124 with netmask set to 255.255.255.224?
decimal binary network address 126.96.36.199 10100001 00110101 01011011 00000000 netmask 255.255.255.224 11111111 11111111 11111111 11100000
188.8.131.52 184.108.40.206 220.127.116.11 18.104.22.168, 22.214.171.124 126.96.36.199 188.8.131.52 184.108.40.206
How can I select hosts with addresses in range 220.127.116.11 to 18.104.22.168?
first host 22.214.171.124 10100001 00110101 00000101 00010000 last host 126.96.36.199 10100001 00110101 00000101 00011111 (all selected hosts) 10100001 00110101 00000101 0001xxxx
It can be observed that host part is last four bits of the address, which leads to the netmask of 255.255.255.240. Network address is address of any of the hosts ANDed with netmask:
any host 10100001 00110101 00000101 0001xxxx netmask 255.255.255.240 11111111 11111111 11111111 11110000 network 188.8.131.52 10100001 00110101 00000101 00010000
 Douglas E. Comer "Internetworking With TCP/IP - Principles, Protocols, and Architecture"  Uyless Black "TCP/IP and Related Protocols"