jasonish/py-idstools

eve2pcap.py fails with IPv6 addresses

cherdt opened this issue · 1 comments

I get the following message when using an eve log entry with IPv6 addresses as input:

socket.gaierror: [Errno 8] nodename nor servname provided, or not known

I altered the following line in payload2packet() to get it to work for IPv6:

packet = IP(src=event["src_ip"], dst=event["dest_ip"])

to

packet = IPv6(src=event["src_ip"], dst=event["dest_ip"])

...and now it's working fine without any changes. Sorry for the noise!