DIPv6E

The Impacted IPv4 IP address that was mapped to (for example, target or server).

Data Type

IP

Aliases

Field Relationships

• SIP

• SIPv4

• SIPv6

• SIPv6E

• Origin Hostname

• Origin Hostname or IP

• Origin NAT IP

• DIP

• DIPv4

• DIPv6

• Impacted Hostname

• Impacted Hostname or IP

• Impacted NAT IP

• Origin Port

• Origin NAT Port

• Impacted Port

• Impacted NAT Port

• Origin MAC Address

• Impacted MAC Address

• Origin Interface

• Impacted Interface

• Origin Domain

• Impacted Domain

• Origin Login

• Impacted Account

• IANA Protocol Number

• IANA Protocol Name

Common Applications

Networked equipment

Use Case

Host context

MPE/Data Masking Manipulations

Polyfield – Origin Host

Usage Standards

• Do not override/overload, use <dipv6e> not (?<dipv6e>.*?).

• Impacted is Server (In Client-Server Model).

• Impacted is Target (In Attacker-Target Model).

• Use when you see an Impacted IPv4 address mapped to IPv6.

Examples

• Windows Event Log

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Iphlpsvc' Guid='{66a5c15c-4f8e-4044-bf6e-71d896038977}'/><EventID>4200</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-08-02T19:20:14.492842100Z'/><EventRecordID>5823520</EventRecordID><Correlation/><Execution ProcessID='920' ThreadID='3936'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\SYSTEM'/></System><EventData><Data Name='ProtocolType'>1</Data><Data Name='Interface'>isatap.{f7eec065-6118-437c-8414-eeeeeeeeeeeee}</Data><Data Name='Address'>fe80::5efe:1.1.1.1</Data></EventData></Event>