Bug #307
closed
Added by Sander Klein over 12 years ago.
Updated over 12 years ago.
Description
When capturing IPv6 traffic the addresses are displayed like: 2001:bad:c0ff:33::1234:80 (fast.log, suricata.log, http.log)
This is a bit confusing since it could mean 2001:0bad:c0ff:0033:0000:0000:1234:0080 or 2001:0bad:c0ff:0033:0000:0000:0000:1234 port 80.
I think it would be better to output IPv6 address like: [2001:bad:c0ff:33::1234]:80.
Files
- Status changed from New to Assigned
- Assignee set to Peter Manev
- Priority changed from Low to Normal
- Target version set to 1.1beta3
- Estimated time set to 2.00 h
Peter can you figure out how Snort does it in it's fast log output? And barnyard2. If possible I'd like to stay compatible to those.
Snort does it like:
2001:0bad:c0ff:0033:0000:0000:0000:1234:80
- Assignee changed from Peter Manev to Eric Leblond
I guess that removes the ambiguity as well. Although I like the shorter notation much better, for compatibility we should probably use this as well.
Eric can you update the outputs accordingly?
I attach to this comment two patches that fix this.
- Status changed from Assigned to Closed
- % Done changed from 90 to 100
Also available in: Atom
PDF