ulogd: logging IPv6 flows
Martin Mareš <[email protected]> Wed, 1 Apr 2026 13:55:09 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hello, world!\n I am trying to use ulogd2 to log all flows from conntrack, but I am getting corrupted entries for IPv6 connections. Instead of IPv6 addresses of endpoints, I am getting IPv4 addresses. Apparently, the bytes in memory are interpreted as IPv4: for an IPv6 address starting with 2001:0718:, I see 32.1.7.24. A quick glance at input/flow/ulogd_inpflow_NFCT.c suggests that both IPv4 and IPv6 source addresses are stored under the NFCT_ORIG_IP_SADDR key, but the nfct_okeys array has a fixed ULOGD_RET_IPADDR type for it. I tested ulogd2 2.0.8 from Debian Trixie, but I checked that the revelants bits of the plugin's source does not differ between 2.0.8 and 2.0.9. Have a nice fortnight -- Martin `MJ' Mareš <[email protected]> http://mj.ucw.cz/ United Computer Wizards, Prague, Czech Republic, Europe, Earth, Universe