hello guys,
This is my simple query for port flapping detection
eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND
((host=10.29.18.*) OR (host=10.29.23.*)) OR ((host=10.29.72.*) OR (host=10.29.28.*)) OR ((host=10.11.40.*) OR (host=10.11.41.*) OR (host=10.11.42.*) OR (host=10.11.43.*) OR (host=10.11.44.*) OR (host=10.11.45.*) OR (host=10.11.46.*) OR (host=10.11.47.*) OR (host=10.11.2.*) OR (host=10.11.68.*) OR (host=10.11.2.*)) OR (host=10.29.56.*)
| rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})"
| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)
| stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count
Any hint about why i'm only and always getting results from host in 10.29.56.X network? i'm sure about the existence of entries for others networks.
many thanks
You will always get result from from host in 10.29.56.X network due to where condition
| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)
it will take only those which will satisfy above condition and other network host never contain field- range_10_29_56
so it will never be seen so try fillnull
-
eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND
((host=10.29.18.*) OR (host=10.29.23.*)) OR ((host=10.29.72.*) OR (host=10.29.28.*)) OR ((host=10.11.40.*) OR (host=10.11.41.*) OR (host=10.11.42.*) OR (host=10.11.43.*) OR (host=10.11.44.*) OR (host=10.11.45.*) OR (host=10.11.46.*) OR (host=10.11.47.*) OR (host=10.11.2.*) OR (host=10.11.68.*) OR (host=10.11.2.*)) OR (host=10.29.56.*)
| rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})"
|fillnull
| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)
| stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count
You will always get result from from host in 10.29.56.X network due to where condition
| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)
it will take only those which will satisfy above condition and other network host never contain field- range_10_29_56
so it will never be seen so try fillnull
-
eventtype="cisco_ios-port_down" OR eventtype="cisco_ios-port_up" AND
((host=10.29.18.*) OR (host=10.29.23.*)) OR ((host=10.29.72.*) OR (host=10.29.28.*)) OR ((host=10.11.40.*) OR (host=10.11.41.*) OR (host=10.11.42.*) OR (host=10.11.43.*) OR (host=10.11.44.*) OR (host=10.11.45.*) OR (host=10.11.46.*) OR (host=10.11.47.*) OR (host=10.11.2.*) OR (host=10.11.68.*) OR (host=10.11.2.*)) OR (host=10.29.56.*)
| rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})"
|fillnull
| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)
| stats count,latest(port_status) AS port_status by host,src_interface | sort -count | table host,src_interface,port_status,count
seems that it works fine. i've never heard abt this cmd FILLNULL. many thx to all
@null0, following query seems to restrict the results to range 10.29.56.###
| rex field=host "10\.29\.56\.(?<range_10_29_56>\d{1,3})"
| where (range_10_29_56 >= 0 AND range_10_29_56 <= 127)