[Bro-Dev] IPv6 literal addr constants
Siwek, Jonathan Luke
jsiwek at illinois.edu
Fri Mar 9 09:44:28 PST 2012
> The example that I found yesterday was a607:f8b0::/32 (I get an error message from bro, "unknown identifier a607"). If I write it
> as a607:f8b0::0:0:0:0:0/32, then I still get the same
> error message. Writing it without a double colon
> a607:f8b0:0:0:0:0:0:0/32 seems to work.
> If the first digit is in the range 0-9 (and not in
> the range a-f), then bro does not complain (such
> as 2607:f8b0::/32).
Right, the current rule in scan.l for compressed hex notation looks for the first nibble to be a digit and not a letter. That's fixable, but as I was testing more potential address formats I ran into the ambiguity I mentioned before which doesn't look like it's so easy to work around.
More information about the bro-dev