This message originated from Cribl Community Slack.
Click here to view the original link.
Hi Goaties,
we are looking to activate IPv6 for certain sources.
The source needs to receive via IPv4 alongside with IPv6.
Can anybody assist please? I didnt find any info in regards to this topic in the docs.
Solved
IPv6 Activation Required For Sources Alongside IPv4 Support
Best answer by Jon Rust
yes, you can have ipv4 and ipv6 sources listening on the same port
You'll need 2 sources defined. You can't have 2 addresses defined in 1 source
Hmmh, when we defined :: as IP address it still received the logs sent via IPv4. However the internal __source Field looked really weird.
Is it possible to bind the same port with two different source configs, one with ipv4 and the other with ipv6 for example 6514?
yes, you can have ipv4 and ipv6 sources listening on the same port
this appears to be a limitation of UDP (or our implementation of a UDP server)
the TCP side will work
Filing a bug for this
Thanks Jon. We're upgrading from 4.16.1 to a newer version today. I hope that the bug will resolve itself in the process.
That said, having to manage the same source in two separate configs just because we want to use dualstack seems to be kind of a hassle.
Especially since our syslog "Port to Sourcetype" list for software appliances is already getting quite large.
Sign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.