Splunk Search

How to search for IP addresses that have been hit on more than one port within a short period of time?

Securitas
Engager

I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Securitas,

all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port:

time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80

Running this search will return connects to more than one port by time:

sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1

If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value):

sourcetype="ip_port" | addinfo | eval _time=_indextime 
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1

If you want to see which IP's got connection to the same port at the same time use this:

sourcetype="ip_port" | chart values(port) AS ports over time by ip

Hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Securitas,

all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port:

time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80

Running this search will return connects to more than one port by time:

sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1

If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value):

sourcetype="ip_port" | addinfo | eval _time=_indextime 
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1

If you want to see which IP's got connection to the same port at the same time use this:

sourcetype="ip_port" | chart values(port) AS ports over time by ip

Hope this helps to get you started ...

cheers, MuS

Securitas
Engager

Thanks. That's within the confines of what I was looking for.

Cheers Mate.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...