Index: nulog-core/inl.py =================================================================== --- nulog-core/inl.py (revision 8715) +++ nulog-core/inl.py (working copy) @@ -463,7 +463,11 @@ for j in xrange(len(ip)): i |= ord(ip[j]) << (8 * (len(ip) - j - 1)) - return IP(i, 6).strCompressed() + ipret = IP(i, 6) + if ipret.iptype() == 'IPV4MAP': + return IP('0x'+ipret.strFullsize().lstrip('0000:0000:0000:0000:0000:ffff:').replace(':', '')).strCompressed() + else: + return ipret.strCompressed() else: return IP(int(ip), 4).strCompressed() @@ -473,6 +477,8 @@ @return [string] hexadecimal IP string """ if self.database.ip_type == 6: + if IP(string).iptype() == 'IPV4COMP': + string = '::ffff:' + string.lstrip(':') return '0x%X' % IP(string).int() else: return '%d' % IP(string).int()