7 Replies Latest reply on Jan 25, 2019 9:59 AM by Clint Barnett

    Ip addresses in a range

    Ana Lorite
      Share:|

      Hi all,

       

      Is there any way or function in TPL to calculate every single IP Address in a range?

       

      I mean, having the IP address range 10.6.210.0/24 I'd like to obtain all the IP Address: from 10.6.210.1 to 10.6.210.254

       

      This question is due to I have to create a report which, given an IP Address range, it obtains all the discovered items in that range.

       

      Thanks a million.

       

      Ana.

        • 1. Re: Ip addresses in a range
          Ana Lorite

          Correction in my question: i wanted to say "Query Language" instead of "TPL"

           

          Thanks!

           

           

          • 2. Re: Ip addresses in a range
            Andrew Waters

            Why would you want this in TPL if you plan to use it in a report?

             

            There is no search language function for doing this.

            • 3. Re: Ip addresses in a range
              Andrew Waters

              Depending upon what you mean by discovered, i.e. scanned versus seen with that IP, if the IP range matches a subnet then you could traverse from the Subnet.

               

              Otherwise it would be possible to write a regex which matches the range though it would be very inefficient.

              1 of 1 people found this helpful
              • 4. Re: Ip addresses in a range
                Ana Lorite

                Thanks, Andrew Waters

                 

                Exactly that's what I am trying to: writing a regex expression. I consider your feedback about inefficiency

                 

                Thanks again!

                1 of 1 people found this helpful
                • 5. Re: Ip addresses in a range
                  Brian Morris

                  Good discussion so far, to build on what's already been discussed, here's a query that might help you out or at least get you started. These return all configured interfaces and subnets, not specifically the one that was determined to be the "discovery IP" though.

                   

                  This will match a specific subnet

                  search Host where #DeviceWithAddress:DeviceAddress:IPv4Address:IPAddress.#DeviceOnSubnet:Subnet:Subnet.ip_address_range = "10.6.210.0/24" show name, os, vendor, #DeviceWithAddress:DeviceAddress:IPv4Address:IPAddress.#DeviceOnSubnet:Subnet:Subnet.ip_address_range, #InferredElement:Inference:Associate:DiscoveryAccess.endpoint as 'Scanned via'

                   

                  If you don't care really about the subnet per se (like /24 vs /26, you just want to see all IP's/servers with some IP address that falls in that range) this just shows all IP's that have the same three first octets, you could do this:

                  search Host where #DeviceWithAddress:DeviceAddress:IPv4Address:IPAddress.#DeviceOnSubnet:Subnet:Subnet.ip_address_range matches "10.6.210." show name, os, vendor, #DeviceWithAddress:DeviceAddress:IPv4Address:IPAddress.#DeviceOnSubnet:Subnet:Subnet.ip_address_range, #InferredElement:Inference:Associate:DiscoveryAccess.endpoint as 'Scanned via'

                   

                  • 6. Re: Ip addresses in a range
                    Andrew Waters

                    As mentioned in the above discussion this is only helpful if your report matches the subnet range.

                     

                    If you were going to do this you really should start from the Subnet rather than the Host. This way you don't have to throw away lots of information you have spent time building up (i.e. all the Hosts and all their IPv4 IPAddresses and all the associated Subnets)

                    1 of 1 people found this helpful
                    • 7. Re: Ip addresses in a range
                      Clint Barnett

                      blanket coverage - search DiscoveryAccess where endpoint matches '^10\\.6\\.210\\.'

                      last DA - search DiscoveryAccess where last_marker and endpoint matches '^10\\.6\\.210\\.'

                       

                      If you're only interested in what you've discovered then you could use IPAddress

                       

                      search IPAddress where ip_addr matches '^10\\.6\\.210\\.'

                      1 of 1 people found this helpful