HOME_NET does not accept ipv6 addresses

[bioteseo]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

tap

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I tried to enter an IPv6 network in the HOME_NET field of zeek and suricata configuration and received the following message:
"You must enter a valid IP address or CIDR.
See the Help section of the Security Onion documentation for additional troubleshooting guidance.
The Hunt interface may contain additional log messages to further diagnose the issue."

If I go into Hunt, as suggested, there is no information

If I remove the IPv6 network the change works. On security onion 2.3.x the same entry works.

Any suggestions?

Thanks in advance

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

https://docs.suricata.io/en/suricata-7.0.2/quickstart.html#basic-setup The default already includes the RFC 1918 networks.

[bioteseo]

I think we didn't understand each other, let me try to explain myself better

The problem is in soc->administration->configuration->suricata->config->vars->address-groups->HOME_NET.
The HOME_NET of one of my sensors, contains an ipv4 network (/16) and an ipv6 network (/48). If I enter both, for example:
10.10.0.0/16
2001:0DB8::/48

I get the error shown in the figure. Even if I reverse the order.
If I enter only ipv6 network I do not get error, same if I enter ipv4 network.

The same problem is in soc->administration->configuration->zeek->config->networks->HOME_NET

In this case the ipv6 network just doesn't like it.

Attached are images of the errors.