Inconsistent whitespace between IP and IPv6

[jacobgb24]

When outputting with ndo_vflag > 0 IPv4 addresses have a newline before the IPs while IPv6 do not.

Here's an example:

1523520922.254050 IP (tos 0x0, ttl 107, id 4816, offset 0, flags [none], proto UDP (17), length 74)
    @ipv4@.52249 > @ipv4@.53: [udp sum ok] 51092 A? example.com. (46)
1523520922.254978 IP6 (hlim 54, next-header UDP (17) payload length: 47) @ipv6@.52249 > @ipv6@.53: [udp sum ok]

This is a pretty minor issue, but it'd be nice if it was consistent. I wasn't sure if this was intentional or which way is preferred so that's why this is an issue instead of a pull request.

The newline comes from print-ip.c:468

Personally, I'd prefer a single line of output for easy parsing.

Forgot to mention: tcpdump version 4.9.2 and lippcap 1.8.1, but it doesn't look like the line in question has changed in newer versions.

[infrastation]

I vaguely remember a similar request a few years ago. It would indeed be nice to have the amount of newlines consistent, but if you think how many existing scripts this change would break, it will not look such a good idea.

[infrastation]

If a good solution is possible, tcpdump 5.0 would be a good occasion to apply it at the cost of formatting changes.

[guyharris]

Personally, I'd prefer a single line of output for easy parsing.

At one point, so did Apple, so they added a -g ("g" for "greppable") flag to remove that newline.

For some unknown reason, Apple's change to print-ip.c wasn't preserved as they upgraded to newer versions of tcpdump.org tcpdump, so that flag is now a no-op, even though it's documented.

Perhaps we should implement that flag.

[guyharris]

Perhaps we should implement that flag.

Done in b80f964.

[guyharris]

See also this thread on tcpdump-workers about this issue.