https://github.com/osquery/osquery logo
Title
b

benbass

04/07/2022, 5:17 PM
Has anyone been able to make a label that will only have hosts from a specific vlan?
z

zwass

04/07/2022, 5:24 PM
Would it be possible to detect via IP address in
interface_addresses
?
b

benbass

04/07/2022, 5:25 PM
It should be. I am just not sure how to build the query to focus on a /24.
z

zwass

04/07/2022, 5:30 PM
I'm not great at CIDR, but seems like a /24 could be targeted like
select address from interface_addresses where address like '10.0.0.%';
?
Seems like osquery could use some sqlite utility functions for CIDR though... it just happens to work well with
LIKE
and /24 ranges because it's anything after the last dot (if I'm understanding correctly).
b

benbass

04/07/2022, 5:32 PM
That is what I was thinking - CIDR functionality would be ideal but that isn’t there. I’ll play around and test with the like 10.0.0.% and see if that works for me.
Thank you!
🍻 2