IP Analyzer

The mechanism analyzes lists of IPv4 addresses, providing a extended set of data for each address in the list. Only unique IP addresses are included in the analysis. Checks:

  • IP addresses presence in reputation lists;
  • compliance with GeoIP databases.

If the list contains a prefix from /16 to /32, then it is decomposed into separate IP addresses.

You can analyze:

  • A text file with a list of entries separated by comma, space, semicolon, line break. The entry can be an IP address, an IP address with a mask, an IP address with a colon separated by a port (the port is ignored).
  • .pcap or .pcapng file. Source IPs are analyzed.

Lines commented with a # are not taken into account.

The following checkboxes can be activated for this mechanism:

  • Interactive — an interactive html report is formed instead of a text one;
  • Geo for each IP — add information from GEO databases for each IP address;
  • Countries by IP count — add information about the distribution of IP addresses by countries;
  • AS by IP count — add information about the distribution of IP addresses by AS;
  • External IP lists — add information about IPs matched external reputation lists;
  • Custom IP lists — add information about IPs matched additional reputation lists;
  • SS IP lists — add information about IPs matched reputation lists from the analytics server;
  • Reduced IP lists — check against a shortened list of the most useful lists from every category;
  • Matched IPs — add a list of IP addresses matched with selected reputation lists;
  • Source IPs — add to the report a list of unique source IP addresses from PCAP;
  • Geo for each matched IP — add information from GEO databases for IP addresses matched with selected reputation lists;
  • Countries by matched IP count — add information about the distribution by countries for IP addresses matched with selected reputation lists;
  • AS by matched IP count — add information about the distribution by AS for IP addresses matched with selected reputation lists.

Report

The report is generated as an interactive HTML page. Each section can be collapsed. Inside the sections responsible for checking against reputation lists, a list of all sources that included the analyzed IPs is provided. Double-clicking on an IP address brings up a tooltip that displays a list of all feeds that contain that IP address. If the Geo for each IP checkbox has been set, that IP address will also display country, city, and autonomous system matching information. Some sections have filtration, table export to CSV file or top.

The interactive report can be exported to an HTML page or JSON for later use outside of the PSG.

The report contain sections:

  • Total;

    • Total Unique IP — total number of unique IP addresses from decomposition of all record categories;
    • Matched IPs — number of IPs matched with reputation lists and percentage of the total IPs number;
    • Prefix records parsed — number of prefixes;
    • Unique IP in prefixes — number of unique prefixes;
    • Endpoint records parsed — number of IP addresses with a port;
    • Unique IP in endpoints — number of unique IP-address+port combinations;
    • IP records parsed — number of entries;
    • Unique IP — number of unique IP addresses;
    • Total valid IP records — number of IP addresses;
    • Invalid IP records — the number of values not recognized as IP addresses, if present in the file.

  • Geo for each IP;

    For the IP addresses the corresponding country, city, AS number, AS name are displayed. Filtration for all table fields is available.

  • Countries by IP count;

    For IP addresses, the distribution by countries is displayed in the form of a table and an interactive map.

  • AS by IP count;

    For the IP addresses the distribution by numbers and names of autonomous systems is displayed.

  • IP lists Analysis;

    The section contains a list of all IP addresses for which an entry into the reputation lists was found, with an indication of the list name and entries quantity;

  • Custom IP lists Analysis;

    The section contains a list of all IP addresses for which an entry into the additional reputation lists was found, with an indication of the list name and entries quantity;

  • SS feed IP lists Analysis;

    The section contains a list of all IP addresses for which an entry into the reputation lists from the analytics server was found, with an indication of the list name and entries quantity. Filtering by list names is available, using regular expressions, implemented through 2 input fields: Show and Hide. ; For example, show only feeds with tbl_asn_* in the name and subtract feeds from the results for 30 days;

  • IPs matched any list;

    The section contains lists of IP addresses that were found in at least one of the selected reputation lists.

  • Geo for each matched IP;

    For IP addresses included in at least one of the selected reputation lists, the corresponding country, city, number, and autonomous system name are displayed.

  • Source IPs;

    List of unique source IP addresses extracted from PCAP.

  • Countries by matched IP count;

    For IP addresses included in at least one of the selected reputation lists, the distribution by countries is displayed.

  • AS by matched IP count;

    For IP addresses included in at least one of the selected reputation lists, the distribution by AS is displayed.