Drop_update

[SantiBT]

Hi,

I've just created a new node and I'm seeing events such us: DROP_UPDATE on aggregator type. 

My miner has all domain list but the aggregator has this meessge with "drop_update", do you know it??? Why???

Thanks a lot

[lmori]

Hi @SantiBT,

where do you see the DROP_UPDATE ? in the processor node ? Could you give more details about the types of nodes used in the graph and how they are connected together ?

[SantiBT]

Hi Imori,

Yes, is on aggregator processor, you can see over the logs:

2/3/2017 16:01:56 +0100 TEST-aggr-TEST DROP_UPDATE 0.0.0.0 confidence: 80share_level: redsources: ["test.ipsrc"]first_seen: 1488466915898type: ipv4last_seen: 1488466915898 source_node: TEST-IP-TEST

2/3/2017 16:01:56 +0100 TEST-aggr-TEST DROP_UPDATE 0.0.0.0 confidence: 80share_level: redsources: ["test.ipsrc"]first_seen: 1488466915898type: ipv4last_seen: 1488466915898 source_node: TEST-IP-TEST

My node is config so:

CLASS

minemeld.ft.http.HttpFT
INDICATOR TYPES

IPv4IPv6
TAGS


CONFIG
attributes	
confidence: 80
share_level: red
type: ipv4
delimeter	#
fieldnames	
indicator
ignore_regex	^#
interval	3600
source_name	test.ipsrc
url	http://test.server.local/ip-test.txt

My aggregator config is:

CLASS

minemeld.ft.ipop.AggregateIPv4FT
INDICATOR TYPES

IPv4
TAGS

None
CONFIG
infilters	
NAME	CONDITIONS	ACTIONS
accept withdraws	
__method == 'withdraw'
accept
accept IPv4	
type == 'IPv4'
accept
drop all	
drop
whitelist_prefixes	
wl

I'm seening prefectly the IP on my node but its impossible can see these IPs on the aggregator, I see this message "DROP_UPDATE" always.

Do you know why??

Thanks!

[lmori]

Hi @SantiBT,

problem is in the prototype of the Miner, ipv4 should be IPv4.

[SantiBT]

**bleep**!!!!

jajajajaja

Sorry, I'm stupid.

Thanks a lot!!!

[lmori]

You are welcome !