On Aug 26, 2006, at 9:31 PM, Axton Grams wrote:
To follow up, it seems there are lots of issues storing more than 64
bits of information in a single column; for example, many of the string
functions are only capable of functioning against 64-bits (BIN, HEX,
CONV, FORMAT). After trying to store and retrieve 128 bit values using
mysql, well, I'll let the results speak for themselves:
What do you think? Should be portable across databases (64-bit unsigned
integer), should allow the sorting and grouping as is done with ipv4
today, and does not waste any storage. Could even enable us to group on
network and address for ipv6 traffic, which may be useful.
I can't tell you why it is happening, but your solution makes sense. One point
here to remember is that Snort does not yet support IPv6, so I while we need
to plan ahead, we can't let this hold us up. What you are building looks good.
I plan on trying to review it in detail over the next few days and should be
able to then discuss it in particulars.
GCIA, GCIH, CEH
BASE Project Lead
The next step in IDS analysis!