# Packetbeat IPv6 support

**URL:** <https://discuss.elastic.co/t/packetbeat-ipv6-support/54941>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [July 7, 2016, 11:55am UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941 "2016-07-07T11:55:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![raboof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raboof/32/9851_2.png) [@raboof](https://discuss.elastic.co/u/raboof)\
**Post date:** [July 7, 2016, 11:55am UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941/1 "2016-07-07T11:55:51Z")

</div>

It'd be nice to be able to support IPv6 addresses in packetbeat.

[https://github.com/elastic/beats/blob/master/packetbeat/procs/procs.go](https://github.com/elastic/beats/blob/master/packetbeat/procs/procs.go) currently stores IP addresses in an uint32, where IPv6 addresses are 128 bits.

Would it make sense to modify the SocketInfo struct to use the net.IP type (which can already hold either IPv6 or IPv4 addresses)?

Something roughly like [https://github.com/elastic/beats/compare/master...raboof:packetbeat-ipv6](https://github.com/elastic/beats/compare/master...raboof:packetbeat-ipv6)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 7, 2016, 10:47pm UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941/2 "2016-07-07T22:47:01Z")

</div>

Until recently (relatively), lucene itself couldn't support IPv6 as it didn't have bigint support.  
It now does, and ES 5.0 will also have support for it, so Beat should be able to in the near future too 🙂

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 8, 2016, 10:53am UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941/3 "2016-07-08T10:53:41Z")

</div>

Yes, totally makes sense. Thanks for noticing. packetbeat mostly supports ipv4 and ipv6. That is, if address used for lookup is IPv6, we should do the lookup on `/proc/.../tcp6`.

Some github issue or pull request (do not forget to sign the CLA) is very welcome.

---

<div class="post-metadata">

**Author:** ![raboof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raboof/32/9851_2.png) [@raboof](https://discuss.elastic.co/u/raboof)\
**Post date:** [July 8, 2016, 11:10am UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941/4 "2016-07-08T11:10:41Z")

</div>

> [@steffens](#):
>
> Some github issue or pull request (do not forget to sign the CLA) is very welcome.

I've added [IPv6 support for PacketBeat · Issue #1995 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/1995) - unfortunately it might be a while before someone can sign a CLA for my work, but feedback is already welcome :).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2016, 11:56am UTC](https://discuss.elastic.co/t/packetbeat-ipv6-support/54941/5 "2016-07-28T11:56:23Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.