Updating baseline.
Is that a platform-specific difference?
-::0.0.255.255
+::ffff
-aaaa:bbbb:cccc:dddd:eeee:ffff::2222
+aaaa:bbbb:cccc:dddd:eeee:ffff:0:2222
Yes, looks like inet_ntop()'s give different results depending on where you're at.
How about taking FreeBSD's implementation of inet_ntop() as a starting point for canonicalization? Looks like it follows RFC 5952 well.
+Jon
robin
2
Yes, looks like inet_ntop()'s give different results depending on
where you're at.
This was on Linux.
How about taking FreeBSD's implementation of inet_ntop() as a starting
point for canonicalization?
Do you mean using putting their function directly into Bro, or
something else?
Robin
How about taking FreeBSD's implementation of inet_ntop() as a starting
point for canonicalization?
Do you mean using putting their function directly into Bro, or
something else?
Yeah, taking their code as a starting point, but renaming to something like bro_inet_ntop and using that everywhere instead.
+Jon