GrayLog & PFSense & IPv6 ICMPv6


I’ve tried to get extractor for IPv6 working to no avail and was curious if anyone else has it working.

Started with which works for all IPv4 and most IPv6 traffic, but none of the IPv6 ICMP.

      "title": "pfSense filterlog: IPv6 ICMP",
      "extractor_type": "regex",
      "converters": [
          "type": "csv",
          "config": {
            "trim_leading_whitespace": false,
            "column_header": "RuleNumber,SubRuleNumber,Anchor,Tracker,Interface,Reason,Action,Direction,IPVersion,TOS,ECN,ProtocolID,Protocol,Offset,Length,SourceIP,DestIP,Headers,bourage,ICMP_Type,Flags,unknown_end_field"
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "FilterData",
      "extractor_config": {
        "regex_value": "^(.*)$"
      "condition_type": "regex",
      "condition_value": "(.*?),(in|out),6,0x[0-9a-f]+,0x[0-9a-f]+,.*?,ICMPv6,58,.*$"

any suggestions? the extractor works in test mode.

My GitHub has an extractor for all the things for pfsense.

1 Like

Thanks so much, this is working :pray: