Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IPv6 Adresses are malformed/ivalid #819

Closed
a-czyrny opened this issue Dec 11, 2019 · 3 comments
Closed

IPv6 Adresses are malformed/ivalid #819

a-czyrny opened this issue Dec 11, 2019 · 3 comments
Labels

Comments

@a-czyrny
Copy link
Contributor

a-czyrny commented Dec 11, 2019

Some IPv6 addresses are malformed after the analysis and therefore invalid for later processing.

e.g.:

2a02:8100:0:32:9::145 becomes 2a02:8100::32:9::145

Tested with ndpiReader.

Example pcap: ipv6_example_pcap.zip

@aouinizied
Copy link
Contributor

It's a patch applied to ensure consistency across platforms if we rely on the comment in the code. It's performed using this function:

void ndpi_patchIPv6Address(char *str) {

@a-czyrny
Copy link
Contributor Author

Thanks for pointing that out, i commented out the line. Elasticsearch (in this case) would not accept the values otherwise.

@lucaderi
Copy link
Member

lucaderi commented Apr 9, 2020

The problem is that inet_ntop() is not consistent across all the platforms. The function above is used to patch issues to make test produce the same results on all platforms I am not an IPv6 expert so you should instruct me how to address this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants