When I search for top public IP addresses results include my LAN subnet

[rookie507SL]

Hi mates,

I'm figuring out the reason, why I'm looking LAN addresses as source IP if my search is clearly filtering inbound traffic, coming from Internet.

Is it possible that could be related to something wrong in the firewall ?

For example, if I perform this search

index=index-example sourcetype=firewall src_interface=WAN action=allowed | stats count by src dest service | sort 10 - count

For the query above, I expected to received at the top, public IP addresses. Instead I received subnet IPs 172.20.X.X/24 which is my LAN subnet.

[DalJeanis · Accepted solution]

What part of your search do you believe is clearly filtering for inbound traffic off the internet? In my experience, WAN generally refers to a network belonging to and managed by the business. Try this and see what you get examples of ...

index=index-example sourcetype=firewall src_interface=* action=allowed 
| head 1000
| stats count as mycount by src dest src_interface
| eval rectype="detail" 
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by src | eval rectype="src"]    
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by dest | eval rectype="dest"]
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by src_interface | eval rectype="src_interface"]

[rookie507SL]

Hi DalJeanis,

Thanks for your reply.

Actually, your query prints the results I was expecting. I can see that column "SRC" brings me Private and Public IP addresses, and each of these match the interface column "src_interface".

So, for example, results with "src_interface" as "WAN", all IPs in column "src" are Public IP. On the other hand, results with "src_interface" as "LAN", all IPs in column "src" are Private IP (subnet 172.20.X.X).

But, it is not clear for me yet, why the first query I tried, did not work if I stated src_interface=WAN. I would understand that results or events should include only Public IP addresses.

[rookie507SL]

Sorry, I have to re-state my first query.

The action is not "allowed", it is "blocked".

In this scenario, for some reason if I state src_interface as WAN, the results show src=172.20.X.X IP addresses.