Hi,
Harald Welte writes: ... Current state (working): Apr 10 16:28:22 tunnel v6prod_IN/cleanup:IN=v6prod OUT= MAC=00:02:7e:22:36:f0->00:50:bf:06:b4:f5 TUNNEL=195.226.160.196->195.226.187.050 SRC=2002:3e9e:c5b0:0000:0000:0000:0000:0001 DST=2001:07b0:0180:0000:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=60 FLOWLBL=0 PROTO=TCP SPT=37956 DPT=79 WINDOW=32660 RES=0x00 SYN URGP=0 Found this "->" (introduced by Andras) nicer than my suggestion with local and remote. Only the %03u on IPv4 addresses are a little bit unusual and (mho) can be moved to %u (or %3u). Perhaps an interesting point will be to add an additional tag, which filter causes this log entry, like TRANSPORT=IPv4|IPv6 or FILTER=iptables|ip6tables otherwise it's not easy to "auto"-detect, what filter engine was responsible for that (if log prefixes are not set proper). Peter
