topic Re: Eval to convert IPv6 - to IPv4 Dotted decimal format in Splunk Search

How to convert IPv6 to IPv4 dotted decimal format with eval?

roayers — Tue, 06 Sep 2022 20:49:49 GMT

I've found many samples of how to convert an IPv4 to many different formats but I can't seem to locate one to convert an IPv6 address to IPv4 - Dotted decimal format.

Can anyone help?

Thanks,
Robert

Re: Eval to convert IPv6 - to IPv4 Dotted decimal format

martin_mueller — Sat, 24 Feb 2018 23:23:23 GMT

Splunk has built-in functions to convert hexadecimal to decimal: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/ConversionFunctions#tonumber.28NUMSTR.2CBASE.29
Using that, you can build whatever representation you like for IP addresses.

I can't help you with how to write the eval until you let me know how you'd like the lossy conversion from IPv6 to IPv4 to look like - keep in mind, IPv6 addresses are 128bit while IPv4 ones are only 32bit.

Re: Eval to convert IPv6 - to IPv4 Dotted decimal format

benjimons — Fri, 28 Feb 2020 03:29:02 GMT

There is an RFC related to this. https://tools.ietf.org/html/rfc6144 which speaks of

IPv4-translatable addresses: IPv6 addresses to be assigned to IPv6
nodes for use with stateless translation. They have an explicit
mapping relationship to IPv4 addresses. A stateless translator
uses the corresponding IPv4 addresses to represent the IPv6
addresses. A stateful translator does not use this kind of
addresses, since IPv6 hosts are represented by the IPv4 address
pool in the translator via dynamic state.

Re: Eval to convert IPv6 - to IPv4 Dotted decimal format

gordo32 — Tue, 06 Sep 2022 20:40:32 GMT

Had to do this today because VPN logs for eStreamer returns the IPv4 client_ip field in hex encoded IPv6 format (e.g. 104.33.245.146 is listed as 0000:0000:0000:0000:0000:ffff:6821:f592)

index=estreamer | eval A=if(like(client_ip,"0000:0000:0000:0000:0000:ffff:%"), substr(ipv6,31,9) , client_ip) | eval src_ip=if(len(A)==9, tonumber(substr(A,1,2),16). "." .tonumber(substr(A,3,2),16). "." .tonumber(substr(A,6,2),16). "." .tonumber(substr(A,8,2),16), A)

Not sure what the use case OP originally was looking for, but hope this helps someone.

First eval compares set temp variable A to the hex-encoded IPv4 if matches the format, otherwise stores the IPv6
Second eval parses & converts each IPv4 octet if A is 9 characters long, othewise returns the IPv6

Hope this helps someone else.