You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Plaso's IIS parser is unable to cope with IPv6 addresses with zone index (e.g. %3 suffix). pyparsing's common.ipv6_address doesn't seem to take this into account.
To Reproduce
Plaso version: 20240826 (via Docker)
OS: Debian 12
To reproduce you can try to parse the following log line with Plaso:
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2021-08-07 00:00:01
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2022-01-01 00:01:24 fe80::1ff:fe23:4567:890a%3 POST /powershell clientApplication=ActiveMonitor;PSVersion=5.1.14393.4467 444 random\ranuser1 ::1 Microsoft+WinRM+Client - 200 0 0 15
The method used to install Plaso: Docker
Expected behavior
Plaso should be able to parse log lines that have IPv6 addresses with zone index.
Observed behavior
Plaso produces an extraction warning with "unable to parse log line":
******************* Extraction warnings generated per parser *******************
Parser (plugin) name : Number of warnings
--------------------------------------------------------------------------------
text/winiis : 1
--------------------------------------------------------------------------------
************** Path specifications with most extraction warnings ***************
Number of warnings : Pathspec
--------------------------------------------------------------------------------
1 : type: OS, location: /data/evidences/iis10_edge_cases.log
--------------------------------------------------------------------------------
**************************** Extraction warning: 0 *****************************
Message : unable to parse log line: 5 "2022-01-01 00:01:24
fe80::1ff:fe23:4567:890a%3 POST /powershell
clientApplica..."
Parser chain : text/winiis
Path specification : type: OS, location: /data/evidences/iis10_edge_cases.log
--------------------------------------------------------------------------------
The text was updated successfully, but these errors were encountered:
joachimmetz
changed the title
IIS parser: IPv6 addresses with zone index are not parsed properly
IIS parser: add support for IPv6 addresses with zone index
Oct 6, 2024
Problem
Plaso's IIS parser is unable to cope with IPv6 addresses with zone index (e.g.
%3
suffix). pyparsing's common.ipv6_address doesn't seem to take this into account.To Reproduce
To reproduce you can try to parse the following log line with Plaso:
The method used to install Plaso: Docker
Expected behavior
Plaso should be able to parse log lines that have IPv6 addresses with zone index.
Observed behavior
Plaso produces an extraction warning with "unable to parse log line":
Additional context
Related issue: Unable to parse MS Exchange IIS 10 log lines #4566
The text was updated successfully, but these errors were encountered: