Created 02-23-2017 08:06 AM
After runing Metron a little while,I received this exception:
index [yaf_index_2017.02.23.16], type [yaf_doc], id [AVpp_hu_luwdJ-LP4qUA], message [MapperParsingException[failed to parse [ip_dst_addr]]; nested: IllegalArgumentException[failed to parse ip [ff02::0001:0003], not a valid ipv4 address (4 dots)];]
How do i resolve it ? I'll appreciate it for any help!
Created 02-23-2017 08:59 PM
It looks like Yaf is sending some ipv6 traffic. The Yaf parser is only setup for ipv4. Try adding --ip4-only to the yaf startup script (/opt/yaf/start-yaf.sh). Please let me know if that works and we can open up a JIRA to address it. Thanks! -David...
Created 02-23-2017 08:59 PM
It looks like Yaf is sending some ipv6 traffic. The Yaf parser is only setup for ipv4. Try adding --ip4-only to the yaf startup script (/opt/yaf/start-yaf.sh). Please let me know if that works and we can open up a JIRA to address it. Thanks! -David...
Created 02-24-2017 02:47 AM
Thanks,i will have a try! but i have the same problem with bro.how can i do it ?
Created 02-24-2017 02:53 AM
could you show me how to filter IPv6 in bro logs.
Created 02-24-2017 03:14 AM
btw,it does not works .
Created 02-24-2017 03:25 AM
i am sorry,i take a mistake , your advice works. thks