[Bro-Dev] IPv4 and IPv6 addresses in Broccoli

Matthias Vallentin vallentin at icir.org
Tue Mar 20 12:36:53 PDT 2012


Broccoli uses the following structure to represent addresses:

    typedef struct bro_addr {
      uint32      addr[4];   /**< IP address in network byte order */
      int         size;      /**< Number of 4-byte words occupied in addr */
    } BroAddr;

Why do we need the second field? That is, why don't we use a single 16 byte
array, where the version distinction occurs implicitly through the IPv4
mapped prefix (as in Bro)?

    Matthias


More information about the bro-dev mailing list