topic Re: How to check CIDR overlaps in Splunk Search

How to check CIDR overlaps

yko84109 — Thu, 30 Sep 2021 12:23:08 GMT

I have lookup with CIDR advanced field which contains:

id cidr_field 1 1.1.1.1/24 2 8.8.8.8/24

If I search for single if in the range, i.e:

| makeresults | eval ip="8.8.8.1" | lookup mylookup cidr_field as ip OUTPUT id

It's worked currently, But If I'm tried to search for CIDR it does not return any result:

| makeresults | eval ip="8.8.8.8/28" | lookup mylookup cidr_field as ip OUTPUT id

So how can I search for CIDR in another CIDR?

Re: How to check CIDR overlaps

PickleRick — Thu, 30 Sep 2021 12:27:48 GMT

Do you want to find overlaps or containment?

Because for simple check whether 1.2.3.4/28 is within a 1.2.0.0/16 range you can just drop the mask from the first IP (as long as it's a valid range and the mask is longer).

And what result would you expect in your comparison of - for example 1.0.0.0/8 versus 1.0.2.0/24? Is 1.0.0.0/8 according to your semantics "in" 1.0.2.0/24 or not?

Re: How to check CIDR overlaps

yko84109 — Thu, 30 Sep 2021 13:03:38 GMT

Hi,

I want to check if CIDR exist in another CIDR

Re: How to check CIDR overlaps

PickleRick — Thu, 30 Sep 2021 14:38:49 GMT

Well... you can't really account easily for the cases when the range you want to check is "wider" than the one you have in the lookup.

If your lookup matches the CIDR ranges to unique identifiers, you can try to calculate the "beginning" and "end" of the checked range (possibly using https://splunkbase.splunk.com/app/3490/ to help) and check if both ends are getting looked up into the same value.

Not a pretty solution, but should work.

Otherwise, you cannot easily detect situations in which you're checking, for example 10.0.0.0/8 against 10.0.0.0/24. Normally the iplookup only checks for a single IP.