The IPv4 format is prevalent on the Internet for many years, while the IPv6 format was designed to replace IPv4 by offering potentially many more possible addresses.

IP address data is inserted by the CX Passive Capture Application into the [env] section of the request. The fields that are defined in your search templates can be configured to scan for the presence of this request data. Tealeaf provides search terms in the default templates to search for IP addresses, including the client IP, server IP, and more.

IP addresses in either format can be inserted into any search field that is specified to search for this data.

In the available default templates, IP address specification applies to Session Info\Client IP and Page Info\Server IP. For more information about searching:

IPv4 and IPv6 address are valid IP address formats.

You can use wildcards in any octet (IPv4) or group (IPv6).

In an IPv4 address, a range can be specified in a single octet as:

100-199

For IPv6 address, a range can be specified in one or more groups as:

0000-1000

IPv6 Limitations: none

IPv4 Limitations:

• You can specify a range in only one of the octets.
  • If multiple ranges are specified in a single octet, then the IP address is ignored.
  • If multiple octets each contain ranges, then the IP address is ignored.
• Wildcards can not be included in octet ranges. For example, an IP address with an octet such as CCC-D* is ignored when the search is run.

Examples for IPv4:

In most web applications, the client IP address is contained in the REMOTE_ADDR field in the request.

• Tealeaf provides the search field Session Info\Client IP in the default completed template, which is configured to search for the client IP address, provided it is displayed in REMOTE_ADDR.
• This value is the raw, non-normalized remote address.
• If this value is an IPv6 address, the REMOTE_ADDR contains the IPv6 value in compressed format, if compression is enabled in the PCA.

If the Client IP search field is not available, the client IP address can be available in the [env] or [appdata] section of the request, depending on the rules that are configured for your Windows pipeline.

• If it is an IPv6 address, the value is stored in the [env] section of the request and can be in compressed format, as captured and processed by the PCA.
  Note: If your web infrastructure uses a proxy, such as Akamai, in front of your web servers or if your network traffic is passed through a Network Address Table, the REMOTE_ADDR field does not contain the true client IP address. In these configurations, you must review the request headers for a special label such as HTTP_X_FORWARDING, which contains the true client IP.

  The CX Passive Capture Application can be configured to use the HTTP_X_FORWARDING setting for populating the REMOTE_ADDR value.

For fields identified as an IP address, you can search for IPv4 addresses as a set of four octet values.

To search for IPv4 addresses:

1. From the Session Info panel, click Client IP.

   The search field for Client IP is displayed in the Search Configuration window.

2. In the text field, enter the IP address in the following format:

   AAA.BBB.CCC.DDD
   

   Note: IPv4 addresses entered in the following formats are not supported for search:

   AAA BBB CCC DDD
   AAABBBCCCDDD
   

3. Click Search.

To search for IPv6 addresses:

1. From the Session Info panel, click Client IP.

   The search field for Client IP is displayed in the Search Configuration window.

2. In the text field, enter the IP address

   For IPv6 addresses, you may enter the address in the provided IP address field in either uncompressed or compressed format.

   Note: In IPv6 notation, the port number may be appended to the address in parentheses: (8080). In Tealeaf, searches using port numbers are not supported.

   Note: You cannot search for full, compressed IPv6 addresses. You must apply wildcards to the search string.

   In compressed format, the above address can be entered as follows:

   2001:db8:85a3:0:0:8a2e:370:7334
   

   The compressed address is expanded as part of the submitted query.

   Wildcards and ranges may be applied to IPv6 addresses.

3. Click Search.

Tealeaf captures IP addresses in active session data in their native form. After a session is complete, IP addresses are turned into 12-digit values so they can be easily indexed. For example, the IP address 192.168.0.1 in an active session is rendered into the following value that is stored with the completed session data: 192168000001.

Depending on the type of search, you must specify a free-text search of an IP address in either of the following ways:

• Active Sessions: For active sessions, you can specify the full IP address, by using wildcards. In the previous example, search for 192.168.*.1 matches the above IP address and all other IP addresses whose first, second, and fourth field is the same.
• Completed Sessions: For completed sessions, the IP address is now stored as a 12-digit text string, so wildcards do not apply. Full IP addresses must be supplied. For example, the value 192168000001 for an IP address in a completed session is not equivalent to 192,168,000,001.

  Storing as a numerical value enables searching across ranges of IP addresses.

Annotations provide a mechanism for tracking activities by Tealeaf users about individual sessions. Annotation data is stored with the session data.

After an annotation is saved into a session, the session must be indexed or re-indexed before the annotation is available through search. You cannot search for annotations in active sessions. You can search for annotations through RTV.

To search for annotations:

1. When a search template includes annotations, you can search for either the annotation or the author in the Session Info node.
   Note: You cannot create searches for these fields in combination with other search fields. Annotations and Annotation Authors are indexed through a different document mechanism, which results in null search results when combined with other search fields.
2. Optional: Search for annotations using the free-text search.

   If your search templates do not include the Annotations and Annotation Authors search fields, you can still search for this data by using free text search.

   You must enter the appropriate search keyword for these search items in the text field. Examples:

   • Searching for annotation text:

     annoobject/text contains error

     Previous searches for annotations whose text contains error.

   • Searching for annotation author:

     annoobject/name contains ADMIN

     Previous searches for annotations whose author has the Tealeaf user ID ADMIN.

   If you find yourself frequently using free-text search for annotations, your Tealeaf administrator can add the annotation fields to your search template. The keywords to add are Annotations and Annotation Authors, and MD5 hashing does not apply.