thanks for your concise reponse, dale. i checked the output from phpinfo() and there's no compile option referring to ipv6 so i think i'm safe. i'm not sure at all if my 'system is ipv6 aware'. do you mean the os, the server, the php module, or what here?
my question was basically about the IP information i find in the superglobal environment/server vars about the address from which the client request comes. will this address always consist of 4 numbers between 0 and 255 delimited by 3 periods? my plan is to explode() the IP for comparison of the first 3 numbers.
as for the information not always being available, i think i can live with that. i'm working on some session handling code and since the information is usually there, i have no problem dropping sessions for clients that don't have the information.
i have been using phpBB's session handling as my guide. When a client presents a session id to try to resume an existing session, their session handling code checks the current client IP against the IP address used when a session was created. if the first 3 quadrants of the ip address match, the client is allowed to continue the existing session. Apparently ipv4 can result in different IPs for a single session but this rarely results in a change in any of the first 3 quadrants. if one of the first 3 differs, the code assumes this is a different user (who might be trying to hijack a session) and a access to the existing session is denied. A new empty session is created instead.
