I'm attempting to add IPv6 support in Hatchet (http://www.dixongroup.net/hatchet/), but I'm a little clueless when it comes to IPv6 address formatting. I've read through the IPv6 Addressing Architecture draft (http://www.ietf.org/internet-drafts/draft-ietf-ipv6-addr-arch-v4-00.txt), but that seemed to create more confusion than I started with.
I've seen icmp6 entries in my IPv4-only firewall that represent an address with 6 - 16bit hex values. I've also had an IPv6 user submit examples from their log which shows only 5 - 16bit hex values. Obviously, after looking at the draft, I can see there are a LOT of shorthand methods for representing IPv6 addresses. I'm wondering, though, if PF/pflogd has chosen to represent these addresses in a standard, predictable format, or if it's simply "dumping" the address information as it finds it? I'm only a Perl hacker, so I'm having a heck of a time matching regex for all the possible IPv6 permutations. Thanks, -- Jason Dixon, RHCE DixonGroup Consulting http://www.dixongroup.net
