Packetbeat IPv6 support

[raboof (Arnout Engelen)]

It'd be nice to be able to support IPv6 addresses in packetbeat.

https://github.com/elastic/beats/blob/master/packetbeat/procs/procs.go currently stores IP addresses in an uint32, where IPv6 addresses are 128 bits.

Would it make sense to modify the SocketInfo struct to use the net.IP type (which can already hold either IPv6 or IPv4 addresses)?

Something roughly like https://github.com/elastic/beats/compare/master...raboof:packetbeat-ipv6

[warkolm (Mark Walkom)]

Until recently (relatively), lucene itself couldn't support IPv6 as it didn't have bigint support.
It now does, and ES 5.0 will also have support for it, so Beat should be able to in the near future too

[steffens (Steffen Siering)]

Yes, totally makes sense. Thanks for noticing. packetbeat mostly supports ipv4 and ipv6. That is, if address used for lookup is IPv6, we should do the lookup on /proc/.../tcp6.

Some github issue or pull request (do not forget to sign the CLA) is very welcome.

[raboof (Arnout Engelen)]

@steffens

Some github issue or pull request (do not forget to sign the CLA) is very welcome.

I've added IPv6 support for PacketBeat · Issue #1995 · elastic/beats · GitHub - unfortunately it might be a while before someone can sign a CLA for my work, but feedback is already welcome :).