Our Community is getting an upgrade! To get everything ready for the relaunch, we’ll be placing the site in read-only mode starting September 21st.
We really appreciate your understanding while we get things set up behind the scenes. Catch up on all the exciting details about the move here.
Need help or have questions? Drop us a line at [email protected]

Archives of Support Questions (Read Only)

This is an archived board for historical reference. Information and links may no longer be available or relevant
Announcements
This board is archived and read-only for historical reference. To ask a new question, please post a new topic on the appropriate active board.

Exception in indexingBolt of indexing topology

avatar
New Member

After runing Metron a little while,I received this exception:

index [yaf_index_2017.02.23.16], type [yaf_doc], id [AVpp_hu_luwdJ-LP4qUA], message [MapperParsingException[failed to parse [ip_dst_addr]]; nested: IllegalArgumentException[failed to parse ip [ff02::0001:0003], not a valid ipv4 address (4 dots)];]

How do i resolve it ? I'll appreciate it for any help!

1 ACCEPTED SOLUTION

avatar
Expert Contributor

It looks like Yaf is sending some ipv6 traffic. The Yaf parser is only setup for ipv4. Try adding --ip4-only to the yaf startup script (/opt/yaf/start-yaf.sh). Please let me know if that works and we can open up a JIRA to address it. Thanks! -David...

View solution in original post

5 REPLIES 5

avatar
Expert Contributor

It looks like Yaf is sending some ipv6 traffic. The Yaf parser is only setup for ipv4. Try adding --ip4-only to the yaf startup script (/opt/yaf/start-yaf.sh). Please let me know if that works and we can open up a JIRA to address it. Thanks! -David...

avatar
New Member

Thanks,i will have a try! but i have the same problem with bro.how can i do it ?

avatar
New Member

could you show me how to filter IPv6 in bro logs.

avatar
New Member

btw,it does not works .

avatar
New Member

i am sorry,i take a mistake , your advice works. thks