What causes "Invalid IP %s" in apache/cassandra?

Pass a syntactically valid IP literal (IPv4 or IPv6), e.g. validate with InetAddress.getByName or a regex before the call.

apache/cassandra · error · IllegalArgumentException

Invalid IP %s

Error message

Invalid IP %s

What it means

CIDRGroupsMappingManager.getCidrGroupsOfIP resolves the given IP string via InetAddress.getByName; if the string is not a valid IP literal and cannot be resolved as a host name, UnknownHostException is caught and rethrown as IllegalArgumentException("Invalid IP <ip>"). This guards lookups into the CIDR authorizer's group mapping.

Source

Thrown at src/java/org/apache/cassandra/auth/CIDRGroupsMappingManager.java:235

            existingMappings.remove(cidrGroupName);
        }

        // Delete old CIDR groups which do not exist in new mappings
        for (String cidrGroupName : existingMappings)
        {
            dropCidrGroupIfExists(cidrGroupName);
        }
    }

    public Set<String> getCidrGroupsOfIP(String ipStr)
    {
        try
        {
            return DatabaseDescriptor.getCIDRAuthorizer().lookupCidrGroupsForIp(InetAddress.getByName(ipStr));
        }
        catch (UnknownHostException e)
        {
            throw new IllegalArgumentException("Invalid IP " + ipStr, e);
        }
    }

    public void loadCidrGroupsCache()
    {
        DatabaseDescriptor.getCIDRAuthorizer().loadCidrGroupsCache();
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Pass a syntactically valid IP literal (IPv4 or IPv6), e.g. validate with InetAddress.getByName or a regex before the call.
If a hostname is intended, ensure DNS resolution works or resolve it to an IP first.
Catch IllegalArgumentException and surface a clear validation message to the user.

Example fix

// before
manager.getCidrGroupsOfIP(userInput); // may throw for malformed input
// after
InetAddress addr = InetAddress.getByName(userInput); // validate/format first
manager.getCidrGroupsOfIP(addr.getHostAddress());

Defensive patterns

Strategy: validation

Validate before calling

boolean isValidIp(String s) {
    try { InetAddress.getByName(s); return true; } catch (UnknownHostException e) { return false; }
}
// call only if isValidIp(ip)

Type guard

boolean isIpLiteral(String s) {
    return s != null && (s.matches("^(\\d{1,3}\\.){3}\\d{1,3}$") || s.contains(":"));
}

Try / catch

try { groups = manager.getCidrGroupsOfIP(ip); } catch (IllegalArgumentException e) { log.warn("Skipping CIDR lookup: " + e.getMessage()); }

Prevention

Validate IP strings before passing them to CIDR lookups.
Use InetAddress utilities or a CIDR library to parse and normalize addresses.
Avoid accepting hostnames where IP literals are expected, or resolve them explicitly.

When it happens

Trigger: Calling getCidrGroupsOfIP (e.g. via CIDR-related tooling or CQLSH cidr commands) with a malformed string like '999.1.2.3', 'not-an-ip', or an unresolvable hostname.

Common situations: Copy-pasting IPv6 addresses with typos; passing hostnames in environments without DNS; feeding user-supplied IP strings without validation into CIDR group lookups.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/9dbfff64e3f11952. Report an issue: GitHub.