If you look at the XML EventData of Windows events like 1002 (DHCP error), you will see something like this:

Address1 and Address2 are IPv4 addresses represented as a decimal integer. This can be decoded with many tools, let's try CyberChef:

With this recipe.

The decoded IPv4 address is 4.1.168.192, which is 192.168.1.4 reversed.

That's because CyberChef assumes that the 4 bytes are encoded in big endian format (most significant byte comes first), because that is the "standard for data on the wire".

But in XML eventdata, it is encoded in little endian format (the least significant byte comes first, the opposite of big endian).

With CyberChef, one can find different solutions (recipes) to this problem. Here is one I'm using:

Here is the recipe.

I use one Change IP Format operation to convert the decimal number to hexadecimal, then a Swapp Endianness operation to swap the 4 bytes, and then another Change IP Format operation to display the IPv4 address in dotted decimal format.

If you have better solutions, please post your recipes.

I also have a very short recipe, but some might say I'm cheating ... :-p

I extended the Change IP Format operation with a Decimal (Little Endian) format:

I actually have a PR for this that I should follow up on.

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com