Malformed Syntax Error When Searching ipv6addr With a CIDR of 128
search cancel

Malformed Syntax Error When Searching ipv6addr With a CIDR of 128

book

Article ID: 378305

calendar_today

Updated On:

Products

Carbon Black Hosted EDR (formerly Cb Response Cloud) Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When doing a process search for an IPv6 address with a CIDR range of /128, a malformed syntax error is returned. 

Example Search:

 ipv6addr:::1/128

Environment

  • Carbon Black EDR Console: 7.8.0 and Lower

Cause

IPv6 search handling did not account for single IP returned with IPv6 CIDR range. 

Resolution

The /128 CIDR is a single IP, instead use just the direct IPv6 address as a workaround. 

 ipv6addr:::1

Additional Information

  • This will be corrected in the 7.9.0 server release with CRE-19180