How are IP addresses normalized and stored in Panther?

Last updated: September 3, 2024

QUESTION

How are IP addresses normalized and stored in Panther? For example, how would Panther normalize these identical IPv6 addresses?

  • 1234🔢1234:0000:0000🔢1234:1234

  • 1234🔢1234:🔢1234:1234

  • 1234🔢1234:0:🔢1234:1234

ANSWER

Panther does not change incoming data, but the IPv6 addresses are normalized by expanding them fully (e.g., 1234🔢1234:0000:0000🔢1234:1234) when putting them into p_any_ip_addresses, which is what is used for searching.