Project

General

Profile

Actions

Feature #7047

open

eve: add ip version field

Added by Jason Ish 10 months ago. Updated about 8 hours ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Add a field to EVE records specifying the IP version.

Use case: I wanted to limit a set of eve records down to just IPv4 as there were a lot of IPv6 records in the stream, and there was no field to filter on short of a regular express on the IP addresses.

It actually doesn't seem common for other tools in this space to log this field either. Instead it is often added by post-processing tools based on inspecting the IP addresses.

Possible examples:

"ip_ver": 4

or a key of "ipv, "ip_version", I think this fits our current schema the best.

But I've also seen:

"network_type": "ipv4" 


Related issues 1 (0 open1 closed)

Related to Suricata - Feature #7129: decode: Create a decode event for unknown ethertypesClosedJeff LucovskyActions
Actions #1

Updated by Philippe Antoine about 8 hours ago

Was this not solved by cbda276aebf4657fed709368028d6b21acf5c4e7 from #7129

Actions #2

Updated by Philippe Antoine about 8 hours ago

  • Related to Feature #7129: decode: Create a decode event for unknown ethertypes added
Actions

Also available in: Atom PDF