How to check CIDR overlaps

[yko84109]

I have lookup with CIDR advanced field which contains:

id    cidr_field

1     1.1.1.1/24

2      8.8.8.8/24

If I search for single if in the range, i.e:

| makeresults | eval ip="8.8.8.1"
| lookup mylookup cidr_field as ip OUTPUT id

It's worked currently, But If I'm tried to search for CIDR it does not return any result:

| makeresults | eval ip="8.8.8.8/28"
| lookup mylookup cidr_field as ip OUTPUT id

So how can I search for CIDR in another CIDR?

[PickleRick]

Do you want to find overlaps or containment?

Because for simple check whether 1.2.3.4/28 is within a 1.2.0.0/16 range you can just drop the mask from the first IP (as long as it's a valid range and the mask is longer).

And what result would you expect in your comparison of - for example 1.0.0.0/8 versus 1.0.2.0/24? Is 1.0.0.0/8 according to your semantics "in" 1.0.2.0/24 or not?

[yko84109]

Hi,

I want to check if CIDR exist in another CIDR

[PickleRick]

Well... you can't really account easily for the cases when the range you want to check is "wider" than the one you have in the lookup.

If your lookup matches the CIDR ranges to unique identifiers, you can try to calculate the "beginning" and "end" of the checked range (possibly using https://splunkbase.splunk.com/app/3490/ to help) and check if both ends are getting looked up into the same value.

Not a pretty solution, but should work.

Otherwise, you cannot easily detect situations in which you're checking, for example 10.0.0.0/8 against 10.0.0.0/24. Normally the iplookup only checks for a single IP.