Searching for IP addresses

You can create RTV search fields to search for IP addresses in completed sessions in IPv4 format, IPv6 format, or both.

Note: Before you can search for IPv6 formatted addresses, you must update the search templates in use in RTV. The following fields must be added:

Table 1. Searching for IP addresses
REQTEXT
Field Name	Search Keyword	Description
`IP Address`	`ipv6_remote_addr`	Search for IP addresses in IPv6 format or IPv4 format: For IPv6 addresses inserted into this field, values are expanded, if they are condensed, and zero-padded to ensure a string of consistent length. For IPv4 addresses inserted into this field, values are expanded into an IPv6-style formatting, in which each of the four octets of the IPv4 is dispersed into the last four groups of the 8-group IPv6 format. Ranges and wildcards are accepted for this field
`IP Address (legacy)`	`tltstsipaddr`	Search for IP addresses in IPv4 format Data that is entered into fields of this type are zero-padded and normalized into a single string of digits before submission for search.

For active sessions, no indexing is done on these fields. As a result, IP addresses of either format are treated as text strings.

Examples:

Table 2. Searching for IP addresses
REQTEXT
Field Name	Example Value	Description
`IP Address`	`fe80::020b:dbff:fe93:a461-a465`	Searches for a range of indexed values for addresses: `fe80 0000 0000 0000 020b dbff fe93 a461~~a465` Note: For IPv6 addresses, you can specify ranges in one or more groups as needed.
`IP Address (legacy)`	`127.0.0.1`	Searches for a single IPv4 addresses: `127000000001` Note: For IPv4 addresses, search across ranges of addresses is not supported.

RealiTea Viewer