wennan.he
10/20/2022, 10:28 PMroberto
10/21/2022, 2:06 PMselect ia.address, id.mac, id.interface
from interface_details id join interface_addresses ia
on ia.interface = id.interface where length(mac) > 0
order by (ibytes + obytes) desc
and then we do some programmatic filtering to discard link-local and loopback interfaces
are you able to provide more details about the format that the problematic IPs have? Are the hosts VMs or containers by any chance?wennan.he
10/21/2022, 6:33 PMroberto
10/24/2022, 1:03 PMselect
ia.address,
id.mac
from
interface_addresses ia
join interface_details id on id.interface = ia.interface
join routes r on r.interface = ia.interface
where
r.destination = '0.0.0.0'
and r.type = 'gateway'
order by
instr(ia.address, '.') desc
wennan.he
10/24/2022, 5:02 PMroberto
10/26/2022, 9:41 PMwennan.he
10/27/2022, 12:06 AM