Project

General

Profile

Actions

Bug #307

closed

IPv6 output confusing

Added by Sander Klein about 10 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When capturing IPv6 traffic the addresses are displayed like: 2001:bad:c0ff:33::1234:80 (fast.log, suricata.log, http.log)

This is a bit confusing since it could mean 2001:0bad:c0ff:0033:0000:0000:1234:0080 or 2001:0bad:c0ff:0033:0000:0000:0000:1234 port 80.

I think it would be better to output IPv6 address like: [2001:bad:c0ff:33::1234]:80.


Files

Actions #1

Updated by Victor Julien about 10 years ago

  • Status changed from New to Assigned
  • Assignee set to Peter Manev
  • Priority changed from Low to Normal
  • Target version set to 1.1beta3
  • Estimated time set to 2.00 h

Peter can you figure out how Snort does it in it's fast log output? And barnyard2. If possible I'd like to stay compatible to those.

Actions #2

Updated by Sander Klein about 10 years ago

Snort does it like:

2001:0bad:c0ff:0033:0000:0000:0000:1234:80

Actions #3

Updated by Victor Julien about 10 years ago

  • Assignee changed from Peter Manev to Eric Leblond

I guess that removes the ambiguity as well. Although I like the shorter notation much better, for compatibility we should probably use this as well.

Eric can you update the outputs accordingly?

Actions #5

Updated by Victor Julien about 10 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 90 to 100

Applied, thanks Eric.

Actions

Also available in: Atom PDF