Looking for the most efficient way to find 2 way traffic in flow data for a particular set of IP/port/protocol combinations: index=flow protocol=6 AND src_port IN (94, 407, 1417, 1418, 1419, 1420) OR dest_port IN (94, 407, 1417, 1418, 1419, 1420) AND NOT src_port IN ( 21, 22) AND NOT dest_port IN ( 21, 22) This gets us the inital data set but having trouble formulating an efficient way to find matching events where src_ip = dest_ip and dest_ip = src_ip from the intial query and flow protocol=6 AND src_port IN (94, 407, 1417, 1418, 1419, 1420) OR dest_port IN (94, 407, 1417, 1418, 1419, 1420) AND NOT src_port IN ( 21, 22) AND NOT dest_port IN ( 21, 22) For example: src_ip = 10.1.1.10, src_port=94, dest_ip= 10.1.1.1, dest_port=407 would match: src_ip = 10.1.1.1, src_port=94, dest_ip= 10.1.1.10, dest_port=407 src_ip = 10.1.1.1, src_port=1418, dest_ip= 10.1.1.10, dest_port=407
... View more
