Single IP Address and Single Mac Address

Content Authoring
1

I am trying to break out IP addresses to be associated with their interface as a custom property. I need a single value not multiple IPs. It seems like no matter what I do I am getting multiple IPs listed.

ANy help would be greatly appreciated

2

Sounds like you are always getting multiple answers, some of which will include loopback.

Depends on what you are trying to get, if you could give some examples?

3

This gets me close, but it will not show the active VPN connection.

addresses whose (it as string != “0.0.0.0” and (it as string contains “169.” or it as string contains “192.”)!=true and it as string starts with (preceding text of last “.” of (addresses of gateway lists whose (address of it != “0.0.0.0”) of adapters whose (address of it != “0.0.0.0”) of network as string))) of ip interfaces whose (loopback of it = false) of network

I am looking for the active connection IP that it is using to talk to Bigfix

4

How about using the registration address of <client>: ipv4or6 address inspector?

5

Thanks! I am getting close.

This gives me the IP:

preceding text of last ", " of (concatenation ", " of (addresses whose (it as string != “0.0.0.0” and it as string does not contain “192.”) of ip interfaces whose (loopback of it = false) of network as string))

How would I get the MAC address from this? I am brand new to relevance language so this is a major feat for me.

6

You need to switch to the adapters type and stay in the type so if you rework this (and I changed it to 193 as my IP on my VM is 192)

q: (address of it, mac address of it ) of adapters  whose ( loopback of it = false AND address of it != "0.0.0.0" AND address of it as string does not start with "193.") of network 
A: 192.168.119.129, 00-0c-29-b6-6b-03
7

Thanks AlanM. That got me extremely close!

Is there any way to tell which value was registered most recently? Sometimes I get multiple values in the cell and I really just want the most recent.

8

Its going to be a bit hard there. As @Aram mentioned registration address of client will give you the address the client is registered to the server with… but from its viewpoint. If the client is behind a NAT it will be the address of the NAT for example.

You might also want to add an up of it to the whose to only include adapters that are active?

1 Like
9

http://bigfix.me/relevance/details/3000004

Added “up of it” plus filtering out all private IPs (plus a small amount of public ones)

(address of it, mac address of it ) of adapters whose ( up of it AND loopback of it = false AND (it as string does not start with "172." AND it as string does not start with "10." AND it as string does not start with "192.168." AND it as string does not start with "169.254." AND it as string does not start with "127." AND it as string does not start with "0.") ) of network
10

I am trying to find network connections starting with a string that matches on the first 3 octets, but I am seeing the below error.

Relevance language:

(address of it) of adapters whose ( up of it AND loopback of it = false AND (it as string starts with "x.x.x.")) of network

Error Description

The cast ’ as string 'is not defined

I am not savvy with relevance, any help is appreciated. For the string “x.x.x.”, I am making sure that the first 3 octets of the IP address are valid. For example, “192.168.1.”.

11

Danger - you may get no results for ‘registration address of client’ if the machine has more than a (a fixed number that I think is 3 but I’m not sure) IP addresses assigned

12

Are you using the Fixlet Debugger? Highly recommend that because of the syntax highlighting and highlighting the references for ‘it’.

You are very close, but where your are including it as string starts with "x.x.x.x", “it” is referring to “adapters”, not “address of it”.

Try

addresses whose (it as string starts with "192.168.1.") of adapters whose ( up of it AND loopback of it = false) of network
1 Like