Classify Custom Networks | LogRhythm Documentation

You can classify custom networks on the packet side or the flow side. This example shows how a custom network is defined. After the network is defined, the DPA rule can use logic that depends on whether or not the traffic belongs to that network. In this instance, a log message is printed only if any end sessions that were on the defined local network are discovered.

function Flow_ClassifyCustomNetworkTraffic (dpiMsg, ruleEngine)

require 'LOG'

require 'IPv4LanDefine'

if (ipRange == nil) then

ipRange = IPv4LanDefine:new('10.0.0.0', '10.0.0.10')

end

if IsFinalLongFlow(dpiMsg) or IsFinalShortFlow(dpiMsg) then

local destip = GetDstIP4Int(dpiMsg)

local srcip = GetSrcIP4Int(dpiMsg)

if (ipRange:IsInLan(destip) or ipRange:IsInLan(srcip)) then

EZINFO("Local network traffic found, srcip: " .. GetSrcIP4String(dpiMsg) .. ", dstip: " .. GetDstIP4String(dpiMsg))

end