Invalid argument provided. String or Buffer required error

Triggers
#1

I’m writing a custom NAS enumeration script that uses the CIFS_RESPONSE event. I require the script to parse, client IP, server IP and CIFS.share telemetry.

However, only the source IP will be used as a key_name for the session table as i’m trying to identify all the share and destination IP accessed by a single client IP

When attempting to map the key_name using the source IP, i received this error, “Invalid argument provided. String or Buffer required”.

When checking for the type of data, source IP is categorized as a buffer object, while my constant variable is just a string. So i’m not sure what is the causing the error.

I tried the same way of mapping the key_name using the HTTP_RESPONSE event type but d.d not receive the same error.

<CIFS_RESPONSE>
>
> const KEYNAME_SMB_CIFS_enum_v2 = "v5_BSMBCIFS_Rsp2";
> if(event == CIFS_RESPONSE)
>      updateSessionEntry (Flow.client.ipaddr, Flow.server.ipaddr, CIFS.share);
> 
> function updateSessionEntry(src_ip, dst_ip, share){
>      debug("~srciptype2: " + typeof src_ip + "~key: " + typeof KEYNAME_SMB_CIFS_enum_v2); + "\n"
>      let key_name = KEYNAME_SMB_CIFS_enum_v2 + md5(src_ip); --> Error occured here
>}

image
image802×262 15.6 KB 

<HTTP RESPONSE>
> 
> const KEY_NAMESPACE = "comb_c2";
> 
> if(event == HTTP_RESPONSE)
>      updateSessionEntry (Flow.client.ipaddr, Flow.server.ipaddr, HTTP.host);
> 
> function updateSessionEntry(src_ip, dst_ip, host){
>      let key_name = KEY_NAMESPACE + md5(src_ip + trimmed_uri);
}

image
image1011×186 12 KB

Same type of variable but different output.

#2

Realized the HTTP response was working because i concat a string with an object that convert that variable in the md5 function into a string, hence, there is no error.

Initially thought the source IP address is stored as a buffer object/ip address data type which should allow me to convert it to hash.

#3

IP addresses are special objects, but have built-in handling to deal with cases where a string is needed. For instance, you shouldn’t even need to call an explicit .toString() when printing a value.