ip.addr is the IPv4 address. ipv6.addr is the IPv6 address.
I think, it would make sense for ip.addr to be neutral and be the inet_ntop() of whichever IP protocol type it is, and ipv4.addr and ipv6.addr to remain proto specific.
is there eg a way to say 'if its ipv6, put ipv6.addr in this field, otherwise put ip.addr in this field' as a compact conditional test?
asked 14 Jul '15, 11:12
In hindsight this would be great. The one challenge I see is that one needs to create a new ftype 'FT_IP' which fans out to IPv4 or IPv6 based on.... heuristics? There are aggregate fields (like ip.addr), but not types (like the proposed FT_IP).
answered 14 Jul '15, 22:35