Is there translation logic for IPV6 addresses in external access logs in windows?

Question

In the case of ipv6, how does the login source address format with event ID 1149 in Microsoft-Windows-TerminalServices-RemoteConnectionManager be converted to the address queried by the client using the ipconfig command. For example, the address I entered on the client is [2001::311], but the Microsoft-Windows-TerminalServices-RemoteConnectionManager records 0:0:2001::%285409280.

The effect is shown below

Answer 1

Hello,

 

Thank you for posting in Q&A forum.

It is ususal to see such compressed form of IPV6 address.

Due to the address length, it is common to have addresses containing a long string of zeros. To simplify writing these addresses, use the compressed form, in which a single contiguous sequence of 0 blocks is represented by a double-colon symbol (::). This symbol can appear only once in an address. For example, the multicast address FFED:0:0:0:0:BA98:3210:4562 in compressed form is FFED::BA98:3210:4562. The unicast address 3FFE:FFFF:0:0:8:800:20C4:0 in compressed form is 3FFE:FFFF::8:800:20C4:0. The loopback address 0:0:0:0:0:0:0:1 in compressed form is ::1. The unspecified address 0:0:0:0:0:0:0:0 in compressed form is ::.

REF: https://learn.microsoft.com/en-us/dotnet/fundamentals/networking/ipv6-overview

To help other customers who may be facing the same issue, please don't forget to vote if the reply is helpful.

 

Best regards，

Jill Zhou

 

---

If the Answer is helpful, please click "Accept Answer" and upvote it.