Re: QjoRetrieveJournal Entries API - Remote Address

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

> The field is 16 char  and the documentation for the API says the format of
> the data is dependant on the value of the address family. However, when I
> use the api the data in the remote address field looks to be gibberish.

It sounds like a socket address family.  If so, the first two bytes should 
identify the address family.  For example, TCP/IP (v4) would be x'0002', 
and IPv6 would be x'0018'.

The rest of the structure would depend on which address family it was. If 
it's TCP/IP (IPv4), it's laid out as follows:

       1-2 = address family
       3-4 = port number
       5-8 = IP address (binary form)
      9-16 = reserved (always x'00')

What is the binary form of an IP address?  Well, we're used to seeing an 
IP address represented like this:  192.168.0.1.  That's called "dotted" 
format (or "dotted decimal" format.)  There are 4 bytes in an IP address, 
but in dotted format, they've taken those 4 bytes and listed each one as a 
decimal number.  Each byte is separated from the other bytes by a period.

So, 192.168.0.1 is 4 bytes.  192 is the first, 168 is the second, 0 is the 
third, and 1 is the fourth.  It's designed to be easy to print or type, 
since it uses ordinary decimal numbers like a human being is used to.

On the other hand, the raw binary form (the actual number, in binary, 
without the dots) is used when actually writing programs that communicate 
over a network as well as in the network packets themselves.  In that 
format, 192.168.0.1 would be x'C0A80001' Why?  because x'C0' = 192 (just a 
hex to decimal conversion), x'A8' = 168, x'00' = 0 and x'01' = 1.

So that's my guess as to what you're seeing in the journal entry.  If the 
first two bytes are x'0002' then it probably is.

If you want to know the IP address, you can take bytes 5-8 and feed them 
into the inet_ntoa() API.  It will spit out a "dotted-decimal" IP address 
so that you can display/print it nicely.

> All the other fields look okay.  Does this field have to be converted?  I
> can't find any documentation on the specifics for this field.  Any help
> would be much appreciated.  Thanks.

Please keep in mind that I'm just guessing.  I have extensive experience 
with TCP/IP programming, but very little experience with journal entries. 
So I know my info would be correct if you'd received it during a network 
communications session, but I have no clue if it's accurate for a journal 
entry.  It's just an educated guess.