Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- When I search for top public IP addresses results ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi mates,
I'm figuring out the reason, why I'm looking LAN addresses as source IP if my search is clearly filtering inbound traffic, coming from Internet.
Is it possible that could be related to something wrong in the firewall ?
For example, if I perform this search
index=index-example sourcetype=firewall src_interface=WAN action=allowed | stats count by src dest service | sort 10 - count
For the query above, I expected to received at the top, public IP addresses. Instead I received subnet IPs 172.20.X.X/24 which is my LAN subnet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What part of your search do you believe is clearly filtering for inbound traffic off the internet? In my experience, WAN generally refers to a network belonging to and managed by the business. Try this and see what you get examples of ...
index=index-example sourcetype=firewall src_interface=* action=allowed
| head 1000
| stats count as mycount by src dest src_interface
| eval rectype="detail"
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by src | eval rectype="src"]
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by dest | eval rectype="dest"]
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by src_interface | eval rectype="src_interface"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What part of your search do you believe is clearly filtering for inbound traffic off the internet? In my experience, WAN generally refers to a network belonging to and managed by the business. Try this and see what you get examples of ...
index=index-example sourcetype=firewall src_interface=* action=allowed
| head 1000
| stats count as mycount by src dest src_interface
| eval rectype="detail"
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by src | eval rectype="src"]
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by dest | eval rectype="dest"]
| appendpipe [| where rectype="detail" | stats sum(mycount) as mycount by src_interface | eval rectype="src_interface"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi DalJeanis,
Thanks for your reply.
Actually, your query prints the results I was expecting. I can see that column "SRC" brings me Private and Public IP addresses, and each of these match the interface column "src_interface".
So, for example, results with "src_interface" as "WAN", all IPs in column "src" are Public IP. On the other hand, results with "src_interface" as "LAN", all IPs in column "src" are Private IP (subnet 172.20.X.X).
But, it is not clear for me yet, why the first query I tried, did not work if I stated src_interface=WAN. I would understand that results or events should include only Public IP addresses.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, I have to re-state my first query.
The action is not "allowed", it is "blocked".
In this scenario, for some reason if I state src_interface as WAN, the results show src=172.20.X.X IP addresses.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
