hi, i’ve noticed that in conn.log under id.orig_h and id.resp_h fields it does not show a normal IPv4 address insted i get somthing similar to this ff02::fb or this fe80::219:e3ff:fee7:5d23 can anyone please explain what do these IDs mean?

id.orig_h and id.resp_h fields.

Tim_Desrochers December 11, 2016, 8:28pm 2

That is ipv6 addresding

Topic		Replies	Views
Question about fields in the notice log Zeek	3	81	May 6, 2022
How to encode id.orig_h and id.resp_h in log or have any way to hide it Zeek	6	177	March 14, 2025
Help with searching logs Zeek	15	209	May 6, 2022
originator/responder possibly swapped Zeek	2	156	May 6, 2022
conn.log question Zeek	4	136	May 6, 2022