How to count/map internal traffic for a range of IP addresses?

[splunknewby]

I have the following fields within splunk: srcaddr and dstaddr, and I would like to map the number of internal to internal connections. I.e all internal traffic from srcaddr to any dstaddr on the IPs 10.0.0.0/8 and 198.168.0.0/16.

How would I filter for and compare these variables?

Cheers.

[acharlieh]

First we need to find the internal to internal connections. One way we can do this with the cidrmatch function in a where command like so:

base search | where (cidrmatch("10.0.0.0/8",srcaddr) OR cidrmatch("192.168.0.0/16", srcaddr)) AND (cidrmatch("10.0.0.0/8",dstaddr) OR cidrmatch("192.168.0.0/16", dstaddr)) 

Now I'm not sure what you mean by map the number of connections exactly, but from here you could then add a | stats count to get the count of internal to internal connections, or do any other statistical function. (If you could clarify more of what you want I could have a better recommendation)

[splunknewby]

Hi acharlieh, I've tried using cidrmatch(), but I don't get any hits for the following index = main | where cidrmatch("192.168.0.0/16",srcaddr), even though there is data with IP addresses in that range under the main index.

Using where like(srcaddr,"192.168.%") returns results, but doesn't seem to be the best solution.

Also, yes I want to essentially get a count of all internal to internal connections.

[acharlieh]

I wonder if the extraction for srcaddr has a trailing space in it... compare the output of these queries:

| noop | stats count | eval srcaddr="192.168.12.1 " | where like(srcaddr,"192.168.%")

| noop | stats count | eval srcaddr="192.168.12.1 " | where cidrmatch("192.168.0.0/16",srcaddr)

| noop | stats count | eval srcaddr="192.168.12.1 " | where cidrmatch("192.168.0.0/16",trim(srcaddr))

| noop | stats count | eval srcaddr="192.168.12.1" | where cidrmatch("192.168.0.0/16",srcaddr)

[splunknewby]

Could the issue be that the srcaddr is being saved as a string?

Is there a way to force Splunk to save the two fields srcaddr and dstadd as IPs?