Question about fields in the notice log

What is the difference between id.orig_h, id.resp_h and src,dst?

Hi Paul,

src and dst are used if there isn’t a connection id.


src: [`addr`]( [`&log`]( [`&optional`](

Source address, if we don’t have a conn_id.

dst: [`addr`]( [`&log`]( [`&optional`](

Destination address.

Not much. :slight_smile: I think the original intent behind them was that in cases where there is no obvious directionality (i.e. non-tcp) the src and dst fields would be used since they indicate the sender and receiver of an individual packet and don't represent a "connection". I've been using the src field for notices that only reference a single host too although ultimately I don't think that's a good thing. We should probably add a host field for cases where only a single host is being referred to in the notice.