# How to encode id.orig\_h and id.resp\_h in log or have any way to hide it

**URL:** <https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723>\
**Category:** Zeek\
**Tags:** scripting, privacy, logging\
**Created:** [March 13, 2025, 5:22am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723 "2025-03-13T05:22:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![trong](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@trong](https://community.zeek.org/u/trong)\
**Post date:** [March 13, 2025, 5:22am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/1 "2025-03-13T05:22:39Z")

</div>

Hi all,  
I wondering that if id.orig\_h and id.resp\_h can be encoded

Thank you everyone for your interest

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [March 13, 2025, 9:53am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/2 "2025-03-13T09:53:48Z")

</div>

Do you mean anonymized? Removed completely? Encrypted?

What is the exact goal that you are trying to achieve?

---

<div class="post-metadata">

**Author:** ![trong](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@trong](https://community.zeek.org/u/trong)\
**Post date:** [March 14, 2025, 1:32am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/3 "2025-03-14T01:32:58Z")

</div>

Sorry for leak of infomartion

I want to Encrypted  
id.orig\_h and id.resp\_h field in zeek with any algorithm

---

<div class="post-metadata">

**Author:** ![trong](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@trong](https://community.zeek.org/u/trong)\
**Post date:** [March 14, 2025, 1:41am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/4 "2025-03-14T01:41:29Z")

</div>

for example, when i try to encrypted data , i got this error  
error in /opt/zeek/share/zeek/site/thx/encrypt/./encrypt.zeek, line 6: type clash in assignment (masked\_rec$id$orig\_h = fmt(%s, rec$id$orig\_h))  
error in /opt/zeek/share/zeek/site/thx/encrypt/./encrypt.zeek, line 7: type clash in assignment (masked\_rec$id$resp\_h = fmt(%s, rec$id$resp\_h))

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [March 14, 2025, 2:01am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/5 "2025-03-14T02:01:56Z")

</div>

I suspect what’s happening is you are just copying the ‘id’ record type in your ‘masked\_rec’ and inside of ‘id’ is orig\_h/resp\_h which are of Type ‘addr’. When you use fmt(), the output is going to be of Type ‘string’. So you end up trying to set a ‘string’ into an ‘addr’.

I hope I’m making sense.

You’ll want to define a different ‘id’ record for your ‘masked\_rec’ so it has a type of string or orig\_h and resp\_h.

-Dop

---

<div class="post-metadata">

**Author:** ![trong](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@trong](https://community.zeek.org/u/trong)\
**Post date:** [March 14, 2025, 3:09am UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/6 "2025-03-14T03:09:04Z")

</div>

Hi Dop  
I am currently processing by copying the Conn log record to create a new similar log but encrytped the orig\_h/resp\_h part, however I am getting an error in the encrytped orig\_h/resp\_h part.

Here is myscript using XOR encrypt.  
@load base/frameworks/logging

function xor\_ip(ip: addr, key: addr): addr {  
local ip\_parts = split\_string(fmt(“%s”, ip), /./);  
local key\_parts = split\_string(fmt(“%s”, key), /./);

```
local masked_ip = "";

for (i in ip_parts) {
    local ip_num = to_count(ip_parts[i]);
    local key_num = to_count(key_parts[i]);
    local xor_result = ip_num ^ key_num;

    if (masked_ip == "")
        masked_ip = fmt("%d", xor_result);
    else
        masked_ip = fmt("%s.%d", masked_ip, xor_result);
}

return to_addr(masked_ip);

```

}

event Conn::log\_conn(rec: Conn::Info) {  
local masked\_rec = rec;

```
local key: addr = 192.168.1.1;

masked_rec$id$orig_h = xor_ip(rec$id$orig_h, key);
masked_rec$id$resp_h = xor_ip(rec$id$resp_h, key);

Log::write(Conn::LOG, masked_rec);

```

}

But I wonder if i can encryped them using base64 or SHA or any other algorithm

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [March 14, 2025, 4:40pm UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723/7 "2025-03-14T16:40:09Z")

</div>

So here’s an example: [https://try.zeek.org/#/tryzeek/saved/fb8f6360024444a4b2fc634296dc1eed](https://try.zeek.org/#/tryzeek/saved/fb8f6360024444a4b2fc634296dc1eed)

What I’ve done here is create a couple new fields that are strings and log those as well. orig\_h and resp\_h are always going to expect a valid IPv4/IPv6 address. In theory, I think you could actually switch the type in the Conn::Info record but that seems troublesome.

I do want to ask what your goal is though. If you’re looking to obfuscate or anonymize your logs to share with others it requires a lot of thought and care. For instance, if for any unique IP it always encrypts into the same value, that becomes more much easily reversible.

-Dop