Hey there 👋 Is there any way to canonicalise IPv4-Mapped IPv6 addresses in osquery? Such that I can filter and query using the IPv4 address of

10.0.2.136

for a connection where the

remote_address

is recorded as

::ffff:0a00:0288

?

That latter address looks like an ipv6 address. I don’t think osquery has any ipv6->ipv4 translation function. Is there a consistent mapping?

Aye. From what I understand these are IPv4 mapped IPv6 addresses. They're a known standard for dual stack, where the first 80-bits are 0, 16-bits are 1 (0xFFFF), followed by the IPv4 address as a dotted quad or hex encoded integer (inet_aton style).

Several things….

Thanks for the replies. In terms of this being an RFC1918 address: I'm aware, these events are related to network connections from a control-plane which intentionally are not internet routable, nor is there any address translation going on 🙂 In terms of

inet_aton

, this only supports a single address family, whereas the replacements

inet_ntop

and

inet_pton

(reverse) support multiple address families - currently, IPv4 and IPv6. I'll have a look into what may be required in order to canonicalise this data at query time, as logs for network connections shipped off-box would otherwise require upstream processing to ensure that the same "encoding" is used for IPv4 connections. Otherwise, if I bucket the data, I'll have one bucket for

::ffff:0a00:0288

and another for

10.0.2.136

despite them being the same address.

Sorry for dropping this… I’m not deeply familiar with the

inet_ntop

and

inet_pton

, but at some level they seem reasonable to add as SQL functions along side the existing

inet_aton

.