[Bro-Dev] IPv4 and IPv6 addresses in Broccoli

Matthias Vallentin vallentin at icir.org
Tue Mar 20 17:59:50 PDT 2012


> I actually prefer the explicit size field for Broccoli but for a
> different reason: it makes it easier for applications to differentiate
> between IPv4 and v6. Otherwise, each client application needs to
> implement our v4-in-v6 mapping in same way (even if standard).

I see your point, but wouldn't it suffice to provide an additional
boolean Broccoli function for that purpose?

>> Should we also change the serialization to always represent addresses
>> as 16 bytes?  Seems inefficient right now, but I guess it would
>> eventually become better once IPv6 addresses are the more frequent
>> type.
>
> (No opionion here, fine either way).

I agree with Jon that such a change may not yet amortize, but at some
point in the future. We could still revisit it then.

    Matthias



More information about the bro-dev mailing list