{"record":{"id":"afb7937d70a94e6c","repo":"elastic/elasticsearch","slug":"invalid-source-port","errorCode":null,"errorMessage":"invalid source port [{}]","messagePattern":"invalid source port \\[(.+?)\\]","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java","lineNumber":233,"sourceCode":"\n        Flow flow = new Flow();\n        flow.source = InetAddresses.forString(sourceIpAddrString);\n        flow.destination = InetAddresses.forString(destIpAddrString);\n\n        Object protocol = ianaNumber;\n        if (protocol == null) {\n            protocol = transport.get();\n            if (protocol == null) {\n                return null;\n            }\n        }\n        flow.protocol = Transport.fromObject(protocol);\n\n        switch (flow.protocol.getType()) {\n            case Tcp, Udp, Sctp -> {\n                flow.sourcePort = parseIntFromObjectOrString(sourcePort.get(), \"source port\");\n                if (flow.sourcePort < 1 || flow.sourcePort > 65535) {\n                    throw new IllegalArgumentException(\"invalid source port [\" + sourcePort.get() + \"]\");\n                }\n                flow.destinationPort = parseIntFromObjectOrString(destinationPort.get(), \"destination port\");\n                if (flow.destinationPort < 1 || flow.destinationPort > 65535) {\n                    throw new IllegalArgumentException(\"invalid destination port [\" + destinationPort.get() + \"]\");\n                }\n            }\n            case Icmp, IcmpIpV6 -> {\n                // tolerate missing or invalid ICMP types and codes\n                flow.icmpType = parseIntFromObjectOrString(icmpType, \"icmp type\");\n                flow.icmpCode = parseIntFromObjectOrString(icmpCode, \"icmp code\");\n            }\n        }\n\n        return flow;\n    }\n\n    @Override\n    public String getType() {","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java#L215-L251","documentation":"Inside buildFlow for transport types Tcp/Udp/Sctp the parsed source port must satisfy 1 <= port <= 65535. Port 0 and values above 65535 are rejected, even though parseIntFromObjectOrString would have returned them as a valid int. The value as-provided (sourcePort.get()) is interpolated into the message.","triggerScenarios":"A document whose source.port field is 0, negative, > 65535, or a Number/String that parses to such a value, with transport resolving to TCP/UDP/SCTP. Note: a null port resolves to 0 via parseIntFromObjectOrString and therefore also throws.","commonSituations":"Sensors emitting port 0 for 'any port'; ephemeral port fields mis-typed as signed short wrapping negative; hex string values that decode out-of-range; missing port field combined with a TCP/UDP transport.","solutions":["Ensure source.port is an integer in [1,65535] for TCP/UDP/SCTP flows before community_id runs.","If port 0 is genuinely valid in your data, document/override the behavior upstream — the processor does not accept it.","For events where the port is genuinely unknown, leave network.transport unset or use an ICMP-typed transport so the port check is skipped.","Route failures through on_failure."],"exampleFix":"// before — port 0 fails for a TCP flow\n//   { \"source\": { \"ip\": \"10.0.0.1\" }, \"source\": { \"port\": 0 }, \"network\": { \"transport\": \"tcp\", \"iana_number\": 6 } }\n//\n// after — port in the valid 1..65535 range\n//   { \"source\": { \"ip\": \"10.0.0.1\", \"port\": 54321 }, \"destination\": { \"ip\": \"10.0.0.2\", \"port\": 443 }, \"network\": { \"transport\": \"tcp\" } }","handlingStrategy":"validation","validationCode":"boolean isValidPort(Object o) {\n    if (o instanceof Number n) { int p = n.intValue(); return p >= 1 && p <= 65535; }\n    if (o instanceof String s && s.matches(\"-?\\\\d+\")) {\n        int p = Integer.parseInt(s); return p >= 1 && p <= 65535;\n    }\n    return false;\n}","typeGuard":null,"tryCatchPattern":"{\n  \"community_id\": {\n    \"on_failure\": [\n      { \"set\": { \"field\": \"ingest.error\", \"value\": \"community-id-bad-source-port\" } },\n      { \"redirect\": { \"pipeline\": \"quarantine\" } }\n    ]\n  }\n}","preventionTips":["Treat port 0 as invalid for TCP/UDP/SCTP flows — community_id does not accept it.","Pre-validate port fields are integers in [1,65535] before community_id runs.","For port-less flows, classify transport as ICMP so the range check is skipped."],"tags":["ingest","community-id","port","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}