Search for IP Addresses more efficient using wildcards or CIDR ranges

[andylee53]

Hello

I'm looking to run a search in a Firewall log index for connections to a know IP range and trying to decide which is the more efficient way of doing it. As can be seen I'm excluding certain ports we expect to see traffic on I seem to remember that using "!=" is also considered inefficient as well open to other suggestions for using something else.

Current search looks like this

index="pan_logs" sourcetype="pan:traffic" dest_ip="91.226.*.*" | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS remotehost | search dest_port!=48600 dest_port!=22 | table _time dest_ip dest_port remotehost

[to4kawa]

index="pan_logs" sourcetype="pan:traffic" dest_ip="91.226.0.0/16" | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS remotehost | table _time dest_ip dest_port remotehost | where dest_port!=48600 OR dest_port!=22

[gcusello]

Hi @andylee53 ,

in general the use of != isn't a best practice in searches!

In my experience the CIDR is more efficient than wildcards.

Ciao.

Giuseppe

[andylee53]

@gcusello Many Thanks for the reply. I understood about the use of != but cannot think of a better alternative right now

Thanks for confirming the CIDR is more efficient I will give it a try

Regards

Andy