GrayLog & PFSense & IPv6 ICMPv6

Networking & Firewalls
1

Hello,

I’ve tried to get extractor for IPv6 working to no avail and was curious if anyone else has it working.

Started with https://github.com/jbsky/graylog/blob/main/extractors.json which works for all IPv4 and most IPv6 traffic, but none of the IPv6 ICMP.

 {
      "title": "pfSense filterlog: IPv6 ICMP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "trim_leading_whitespace": false,
            "column_header": "RuleNumber,SubRuleNumber,Anchor,Tracker,Interface,Reason,Action,Direction,IPVersion,TOS,ECN,ProtocolID,Protocol,Offset,Length,SourceIP,DestIP,Headers,bourage,ICMP_Type,Flags,unknown_end_field"
          }
        }
      ],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "FilterData",
      "extractor_config": {
        "regex_value": "^(.*)$"
      },
      "condition_type": "regex",
      "condition_value": "(.*?),(in|out),6,0x[0-9a-f]+,0x[0-9a-f]+,.*?,ICMPv6,58,.*$"
    }

any suggestions? the extractor works in test mode.

2

My GitHub has an extractor for all the things for pfsense.

1 Like
3

Thanks so much, this is working :pray: