Splunk Search

How to search for IP addresses that have been hit on more than one port within a short period of time?

Securitas
Engager

I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time.

0 Karma
1 Solution

MuS
Legend

Hi Securitas,

all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port:

time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80

Running this search will return connects to more than one port by time:

sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1

If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value):

sourcetype="ip_port" | addinfo | eval _time=_indextime 
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1

If you want to see which IP's got connection to the same port at the same time use this:

sourcetype="ip_port" | chart values(port) AS ports over time by ip

Hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
Legend

Hi Securitas,

all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port:

time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80

Running this search will return connects to more than one port by time:

sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1

If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value):

sourcetype="ip_port" | addinfo | eval _time=_indextime 
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1

If you want to see which IP's got connection to the same port at the same time use this:

sourcetype="ip_port" | chart values(port) AS ports over time by ip

Hope this helps to get you started ...

cheers, MuS

Securitas
Engager

Thanks. That's within the confines of what I was looking for.

Cheers Mate.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...