|0||denotes a (non-routable) IP address|
|1||denotes an IP address internal to the monitored network|
|2||denotes an IP address external to the monitored network|
Creating the prefix map file that maps IPs to one of these labels is described in the MAPPING FILE section below.
The address type utility provides the following options to the indicated applications.
--stype=ID When ID is 0, pass the record if its source address is non-routable. When ID is 1, pass the record if its source address is internal. When ID is 2, pass the record if its source address is external (i.e., routable and not internal). When ID is 3, pass the record if its source address is not internal (non-routable or external). --dtype=ID As --stype for the destination IP address.
rwcut, rwgroup, rwsort, rwstats, and rwuniq Switches
--fields=FIELDS FIELDS refers to a list of fields to use for the operation. The address type utility makes two additional fields, sType (alias 16) and dType (17) available for display, grouping, sorting, and counting using the rwcut(1), rwgroup(1), rwsort(1), rwstats(1), and rwuniq(1) tools:
sType,16 For the source IP address, prints 0 if the address is non-routable, 1 if it is internal, or 2 if it is routable and external. dType,17 as sType, except for the destination address
To denote an address as non-routable, internal, or external at your site, you will need to create the address_types.pmap file and either install it in the appropriate location (see the FILES section below) or set the SILK_ADDRESS_TYPES environment variable to the files location.
The rwpmapbuild(1) tool creates a prefix map file from a text file. A template for the text file is available in $SILK_PATH/share/silk/addrtype-templ.txt. The text file used to create address_types.pmap must include the following section to ensure that IPs are mapped to the integer values that the addrtype.so expects:
# Numerical mappings of labels label 0 non-routable label 1 internal label 2 external # Default to "external" for all un-defined ranges. default external
The remainder of the file can list CIDR blocks and a label for each block:
# RFC1918 space 10.0.0.0/8 non-routable 172.16.0.0/12 non-routable 192.168.0.0/16 non-routable # My IP space (CMU) 22.214.171.124/16 internal
Once the text file is saved to disk, use rwpmapbuild to create address_types.pmap:
rwpmapbuild --input addresses.txt --output address_types.pmap
SILK_ADDRESS_TYPES This environment variable allows the user to specify the address type mapping file to use. The value may be a complete path or a file relative to SILK_PATH. If the variable is not specified, the code looks for a file named address_types.pmap as specified in the FILES section below. SILK_PATH This environment variable gives the root of the install tree. The SiLK applications check the directories $SILK_PATH/share/silk and $SILK_PATH/share for the address type mapping file, address_types.pmap.
The tools will look for the data file that maps IPs to labels in the following locations. ($SILK_ADDRESS_TYPES is the value of the SILK_ADDRESS_TYPES environment variable, if it is set. $SILK_PATH is value of the SILK_PATH environment variable, if it is set. The use of /usr/local/ assumes the application is installed in the /usr/local/bin/ directory.)
$SILK_ADDRESS_TYPES $SILK_PATH/share/silk/address_types.pmap $SILK_PATH/share/address_types.pmap /usr/local/share/silk/address_types.pmap /usr/local/share/address_types.pmap
rwcut(1), rwfilter(1), rwgroup(1), rwpmapbuild(1), rwpmapcat(1), rwsort(1), rwstats(1), rwuniq(1), pmapfilter(3), silk(7)
|SiLK 126.96.36.199||ADDRTYPE (3)||2016-04-05|