[SPOT-20] [UI] Suspicious Connections Search fails for NetFlow

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Labels: Connections Suspicious netflow
• Environment: Spot code running on MapR 5.2. Hive 1.2; Impala 2.5.0
• Assignee: Leda G. Lima
• Reporter: Terry Healy
• Created: 02/Dec/16 20:18
• Updated: 21/Sep/18 20:06

Description

Several IP addresses are given a score rating of one and saved on the Netflow suspicious pane. Flows > Threat Investigation is then selected. One of the added IPs is selected from the bottom of the list. Two Impala queries run with the notation "Looking for additional details..." The process errors with this message, and returns no results.
---------------------------------------------------------------------------
error Traceback (most recent call last)
<ipython-input-3-126eaf8e54f5> in search_ip(b)
83 get_in_out_and_twoway_conns()
84 add_geospatial_info()
---> 85 add_network_context()
86 display_threat_box(anchor)
87

<ipython-input-4-c45139891d90> in add_network_context()
289 else:
290 #Exact match
--> 291 nwdict[row[0]] = [struct.unpack("!L", socket.inet_aton(row[0]))[0],
292 struct.unpack("!L", socket.inet_aton(row[0]))[0], row[1]]
293

error: illegal IP address string passed to inet_aton

Issue Links

• relates to: SPOT-281 Spot GUI Upgrade