[Bro-Dev] IPv4 and IPv6 addresses in Broccoli

[Robin Sommer]

On Tue, Mar 20, 2012 at 21:29 +0000, you wrote:

> I think I had done that just to be more like how the serialization
> process in Bro represents addresses as the length of the address in

I actually prefer the explicit size field for Broccoli but for a
different reason: it makes it easier for applications to differentiate
between IPv4 and v6. Otherwise, each client application needs to
implement our v4-in-v6 mapping in same way (even if standard).

With that reasoning, we could even make it more explicit: instead of
giving size, give the protocol directly and use a union with separate
fields for v4 and v6 address.

> Should we also change the serialization to always represent addresses
> as 16 bytes?  Seems inefficient right now, but I guess it would
> eventually become better once IPv6 addresses are the more frequent
> type.

(No opionion here, fine either way).

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org