Hi,
I'd like to test a long list of MAC addresses against a single MASTER MAC address.
I'm okay with building the TABLE Response Maps for both but I am unsure on what the most efficient way to proceed is.
Most importantly, what would the eval statements look like ?
i.e. I am comparing octet with octet - "00-00-00-20-1f-fc"
What's the best way to do this and can you provide an example of the expressions I would need.
I have one MASTER and at least 300 MAC addresses to verify.
Thanks.
There would be two stages to solve this problem:
1. store your list of mac addresses into a variable
2. then iterate over the list using "for" or "foreach" and compare it with your master mac address.
#1 - I do not know where your list of mac addresses is stored and in what format. Assume that they are stored in a file with a mac address per line. Then you can use "readfile" to load the contents of a file and then store the response in a variable. But this response is simply a giant string. So what you can do is create a table map (as you said) and using an analysis rule (query extractor), store the value of a column into a variable called "foo".
#2 Now you can do:
foreach mac $foo
if $mac eq $master_mac
then
set found 1
break
else
continue
Note that I am using "eq" operator which does string comparison. So this means that your mac addresses should be stored in a uniform manner in your file. For example, it should not have mixed case hex digits or a zero prefix must not be optional. For example:
aa:aa:aa:aa:aa:aa
aA:aa:aa:aa:aa:aa
will be different.
So will:
01:01:01:00:00:01
1:1:1:0:0:1
