Title
#fleet
b

benbass

04/07/2022, 5:17 PM
Has anyone been able to make a label that will only have hosts from a specific vlan?
zwass

zwass

04/07/2022, 5:24 PM
Would it be possible to detect via IP address in
interface_addresses
?
b

benbass

04/07/2022, 5:25 PM
It should be. I am just not sure how to build the query to focus on a /24.
zwass

zwass

04/07/2022, 5:30 PM
I'm not great at CIDR, but seems like a /24 could be targeted like
select address from interface_addresses where address like '10.0.0.%';
?
5:31 PM
Seems like osquery could use some sqlite utility functions for CIDR though... it just happens to work well with
LIKE
and /24 ranges because it's anything after the last dot (if I'm understanding correctly).
b

benbass

04/07/2022, 5:32 PM
That is what I was thinking - CIDR functionality would be ideal but that isn’t there. I’ll play around and test with the like 10.0.0.% and see if that works for me.
5:32 PM
Thank you!