pfSense » pfSense Packages

Subject
SqStat real-time traffic view truncates IPv6 addresses at first colon ([2001) and groups all connections together¶

Description¶

Overview:
When monitoring real-time active proxy connections via SqStat, client devices using IPv6 addresses are not parsed correctly. Instead of listing unique individual IPv6 client hosts, the interface truncates the address string at the first colon. This causes all active global IPv6 traffic across the entire network to bundle together under a single, broken header entry labeled "[2001".

Steps to Reproduce:
1. Enable IPv6 routing on the local area network.
2. Direct client traffic through the Squid proxy using IPv6 destinations.
3. Open the real-time SqStat traffic monitoring interface.
4. Observe the client host mapping field.

Expected Behavior:
Each unique, full IPv6 address (e.g., [2001:db8:1:1::15]) should be recognized as a distinct client host and displayed in its own dedicated section with its respective connections.

Actual Behavior:
The parser clips the string at the first colon delimiter. It leaves a single hanging open bracket [ and the first block of the address (typically 2001). Every single separate client device using an IPv6 address is forced into this exact same section, making it impossible to see individual device usage or connection counts.

Root Cause Analysis:
The issue lies within the legacy string tokenization logic in the backend parser files (specifically inside sqstat.class.php or its accompanying parsing library). The code uses string operations like explode(':', $address) or simple regex matches designed strictly for IPv4 (IP:PORT). Because IPv6 natively utilizes colons as internal address block separators rather than just a port delimiter, the parser splits the IP address string itself rather than isolating the port at the end.

Suggested Fix / Remediation:
The backend logic needs to be updated to support bracket-enclosed IPv6 hosts or to split string delimiters from right-to-left.

• Replace basic explode logic with a regex check that accounts for bracket structures: ^\[(.*)\]:([0-9]+)$
• Alternatively, isolate the port by targeting only the last colon in the string using native PHP array tools:

$pos = strrpos($address, ':');
// Extract the IP and Port based on the last colon position instead of the first