[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

IPv6 entries in pflog



I'm attempting to add IPv6 support in Hatchet
(http://www.dixongroup.net/hatchet/), but I'm a little clueless when it
comes to IPv6 address formatting.  I've read through the IPv6 Addressing
Architecture draft
(http://www.ietf.org/internet-drafts/draft-ietf-ipv6-addr-arch-v4-00.txt), but that seemed to create more confusion than I started with.
I've seen icmp6 entries in my IPv4-only firewall that represent an
address with 6 - 16bit hex values.  I've also had an IPv6 user submit
examples from their log which shows only 5 - 16bit hex values. 
Obviously, after looking at the draft, I can see there are a LOT of
shorthand methods for representing IPv6 addresses.
I'm wondering, though, if PF/pflogd has chosen to represent these
addresses in a standard, predictable format, or if it's simply "dumping"
the address information as it finds it?  I'm only a Perl hacker, so I'm
having a heck of a time matching regex for all the possible IPv6
permutations.
Thanks,
-- 
Jason Dixon, RHCE
DixonGroup Consulting
http://www.dixongroup.net