What is the best way of doing a where clause for remote addr

Question

What is the best way of doing a where clause for remote address equalling an address either ipv6 or ipv4

Lucas Rodriguez · Answer

Hi What table are you querying

Tor Houghton · Answer

bpf socket events i wish to run a scheduled query for communication outside of my local network

Tor Houghton · Answer

i have a horrible list of and like clauses and it s just getting worse as i eliminate what ends up in the remote address column slightly smiling face

Lucas Rodriguez · Answer

OK I ll check with the team

sharvil · Answer

hey < Tor Houghton> would you mind sharing your query I can try and take a look

sharvil · Answer

Usually the format would be something like `SELECT FROM bpf socket events WHERE remote address = 127 0 0 1 OR remote address = ff ff ff `

Tor Houghton · Answer

I do the following I ve removed the where clauses that filter out rfc1918 addresses in this query because they take up so much space select time path remote address remote port family type protocol from bpf socket events where remote address not like and remote address not like and remote address not like 7f 00 00 01 and remote address not like 127 0 0 and remote address not like 0 0 0 0 order by time desc

sharvil · Answer

Umm I think if is matching with wildcard ` ` it requires multiple `not like`

sharvil · Answer

If you have a limited set of internal ip addresses one could also do something like `select from bpf socket events where remote address not in 127 0 0 1 127 0 0 2 `