Discovery Probe - Linux - Networks regex does not process ip route output when number of Network Adapters is greater than 9 - Known Error

Discovery Probe - Linux - Networks regex does not process ip route output when number of Network Adapters is greater than 9 Description Issue Is:

The Regex Expressions on Line 34 and Line 46 in the Linux - Network probe's post processor script does not process the "iproute" output correctly when the number of adapters is 10 or greater.

Versions: Orlando Release and Later

The Linux - Network probes .sh script parameter was changed in Orlando to accommodate Linux Hosts such as Red Hat version 7 that no longer have the deprecated net-tools application installed and do not reply to ipconfig. The command ip address show was added to the script.

Returns will be "net-tools" or "iproute" if target doesn't respond to ifconfig/net-tools first.

The issue is only on those Linux Hosts with 10 or more Network Adapters that return an output on "iproute"

"linux_network.sh"

#!/bin/sh networkInfo=`ifconfig -a 2> /dev/null && route -n 2> /dev/null` if [ "$?" -eq "0" ]; then echo "net-tools output" echo "$networkInfo" exit 0 fi networkInfo=`ip address show 2> /dev/null && echo Routing Table && ip route 2> /dev/null` if [ "$?" -eq "0" ]; then echo "iproute output" echo "$networkInfo" exit 0 fi echo "both net-tools and iproute commands failed" exit 1

Expected Behavior: The Post Processing Script in the Linux - Network probe's processes and includes all Network Adapters returned in the iproute output payload.

Actual Behavior: The Post Processing Script in the Linux - Networks Probe can hang while processing and does not process all the of Network Adapters returned in the iproute output payload.

Impacted Probe | Linux - Network | SSHCommand | sh ${file:linux_network.sh} discovery_probes_e643f2c2a9fe15610038fc84ebfc075a

Line 34 in the probes post processing script: new RegExp("^\\d:\\s+(\\S+)((?:.*\\n\\s+.*)+)", "gm") Line 46 in the probes post processing script: var macRegex = new RegExp("^\\d:\\s+" + adapterName + ".*link\\/\\S+\\s(\\S+)", "mg"); Only network adapters with a single numerical character, numbered 0 through 9, can be parsed and added to the results. The regex expressions do not account for the second numerical character when the number of an adapter is 10 or greater. Processing can also hang and not provide any results at all. Steps to Reproduce

1. Run Discovery on any Linux server that returns "iproute" network information from the "ip address show" command, has 10 or more Network Adapters, and is using Probes/Sensors instead of Patterns.

2. Open the probes ECC Queue input record to find that adapters numbered 10 or greater that are expected to be processed in the payload are not present.

(NOTE) - Some Network Adapters will not be processed due to the below script include so you may need to verify that the expected Network Adapters are not being removed as expected OOtB.

While calling the getAdapters method defined in the IDSensorUtil script include we pass two more regular expressions [ inet\\s+(\\S+)\\/(\\d+) , inet6\\s+(\\S+)\\/(\\d+) ] to get the IPV4/IPV6 addresses from the adapter, if the adapter matches the regular expression and the ip is not localhost ip [ 127.0.0.1, 0.0.0.0, 255.255.255.255 ] or an unspecified IP then we create the adapter.

Workaround Edit the OOTB RegExp's on Line 34 and Line 46 of the Linux -Network probes post-processing script.

01. On Line 34 place a plus symbol "+" in the 4th character space between the "d" and the ":" in the regex.

OOtB: ^\d : \s+(\S+)((?:.*\n\s+.*)+)

Modified: ^\d + :\s+(\S+)((?:.*\n\s+.*)+)

02.On Line 46 place a plus symbol "+" in the 5th character space between the "d" and the ":" in the regex.

OOtB: ^\\d:\\s+" + adapterName + ".*link\\/\\S+\\s(\\S+)

Modified: ^\\d+:\\s+" + adapterName + ".*link\\/\\S+\\s(\\S+)

03. Save/Update the Linux - Network probe