Looking for the most efficient way to find 2 way traffic in flow data for a particular set of IP/port/protocol combinations:
index=flow protocol=6 AND src_port IN (94, 407, 1417, 1418, 1419, 1420)
OR dest_port IN (94, 407, 1417, 1418, 1419, 1420) AND NOT src_port IN ( 21, 22) AND NOT dest_port IN ( 21, 22)
This gets us the inital data set but having trouble formulating an efficient way to find matching events where src_ip = dest_ip and dest_ip = src_ip
from the intial query and flow protocol=6 AND src_port IN (94, 407, 1417, 1418, 1419, 1420) OR dest_port IN (94, 407, 1417, 1418, 1419, 1420)
AND NOT src_port IN ( 21, 22) AND NOT dest_port IN ( 21, 22)
For example:
src_ip = 10.1.1.10, src_port=94, dest_ip= 10.1.1.1, dest_port=407
would match:
src_ip = 10.1.1.1, src_port=94, dest_ip= 10.1.1.10, dest_port=407
src_ip = 10.1.1.1, src_port=1418, dest_ip= 10.1.1.10, dest_port=407
