Peter
06/14/2022, 11:00 AM10.0.2.136
for a connection where the remote_address
is recorded as ::ffff:0a00:0288
?seph
06/14/2022, 1:43 PMPeter
06/14/2022, 6:56 PMseph
06/14/2022, 7:03 PMselect inet_aton("1.0.1.5") as ipInt ipInt = 16777477
. It don’t see a reverse form.0a00:0288
and then convert it. But it would be some kinda grotty work.Peter
06/15/2022, 11:22 AMinet_aton
, this only supports a single address family, whereas the replacements inet_ntop
and inet_pton
(reverse) support multiple address families - currently, IPv4 and IPv6.
I'll have a look into what may be required in order to canonicalise this data at query time, as logs for network connections shipped off-box would otherwise require upstream processing to ensure that the same "encoding" is used for IPv4 connections. Otherwise, if I bucket the data, I'll have one bucket for ::ffff:0a00:0288
and another for 10.0.2.136
despite them being the same address.seph
07/05/2022, 1:38 PMinet_ntop
and inet_pton
, but at some level they seem reasonable to add as SQL functions along side the existing inet_aton
.