Splunk Search

Find 2 way communication in flow

ky129q
Engager

Looking for the most efficient way to find 2 way traffic in flow data for a particular set of IP/port/protocol combinations:

index=flow protocol=6 AND src_port IN (94, 407, 1417, 1418, 1419, 1420)
OR dest_port IN (94, 407, 1417, 1418, 1419, 1420) AND NOT src_port IN ( 21, 22) AND NOT dest_port IN ( 21, 22)

This gets us the inital data set but having trouble formulating an efficient way to find matching events where src_ip = dest_ip and dest_ip = src_ip
from the intial query and flow protocol=6 AND src_port IN (94, 407, 1417, 1418, 1419, 1420) OR dest_port IN (94, 407, 1417, 1418, 1419, 1420)
AND NOT src_port IN ( 21, 22) AND NOT dest_port IN ( 21, 22)

For example:

src_ip = 10.1.1.10,  src_port=94,  dest_ip= 10.1.1.1, dest_port=407 

would match:

src_ip = 10.1.1.1,  src_port=94,  dest_ip= 10.1.1.10, dest_port=407 

src_ip = 10.1.1.1,  src_port=1418,  dest_ip= 10.1.1.10, dest_port=407

Labels (3)
Tags (2)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!