Tracking servers belong a specific IP range using the "registration address of client"

1

Hi, I need to create a fixlet to only apply to those servers from a specific subnet based on the “registration address of client” output.

For example.

10.186.0.0 to 10.186.0.255
192.168.0.100 to 192.168.0.255

When the registration IP of the server falls into those IP address range, the fixlet will automatic take action.

Tried these but got error:

exists (registration address of client) whose ((it >= “10.186.0.0” as version AND it <= “10.186.0.255” as version AND it = “10.186.0” as version))

values of (registration address of client) whose ((it >= “10.186.0.0” as version AND it <= “10.186.0.255” as version AND it = “10.186.0” as version))

values of registration addresses whose ((it >= “10.186.0.0” as version AND it <= “10.186.0.255” as version AND it = “10.186.0” as version))of client

Any suggestions?

Thanks.

2

I’m not near a computer right now but I’d be inclined to use this.

https://developer.bigfix.com/relevance/reference/ipv4or6-address.html#registration-subnet-address-of-client-ipv4or6-address

If you have webui then use query to build the relevance or create an automatic computer group as it gives the subnet as an option then creates the relevance you’d need.

1 Like
3

Registration address of client returns an IP address object which you can do comparisons on directly with BigFix (no need to pretend it’s a version).

(it >= "192.168.0.1" and it <= "192.168.0.255") of registration address of client

((it >= "192.168.0.1" and it <= "192.168.0.255") or (it >= "10.10.0.1" and it <= "10.10.0.255")) of registration address of client
2 Likes
4

Thanks William, your suggestions work and thanks for clarifying the usage of the “Registration address of client”. Another thing I learned how to probably use inside the relevance statement.

Just another question, using this statement below will check the IP range between 192.168.0.1 - 192.168.0.255 which works great.

(it >= “192.168.0.1” and it <= “192.168.0.255”) of registration address of client

I was hoping that it will also work or cover these IP ranges below as well which it did not:

192.168.2.1 -> .255
192.168.5.1 -> 255

Is there another to define that it will all the IP ranges inside the 192.168.x.x?

Thanks again for everyone to help out. Appreciate it.

5

Hi @yorkly1,

You should be able to modify my second example to achieve what you’re hoping to achieve.

((it >= "192.168.0.1" and it <= "192.168.0.255") or (it >= "10.10.0.1" and it <= "10.10.0.255")) of registration address of client

Expanding this out looks like this:

(
  (it >= "192.168.0.1" and it <= "192.168.0.255")
  or 
  (it >= "10.10.0.1" and it <= "10.10.0.255")
) of registration address of client

You can add as many ranges as you’d like, here’s an example with four ranges:

(
  (it >= "192.168.0.1" and it <= "192.168.0.255")
  or
  (it >= "192.168.5.1" and it <= "192.168.5.255")
  or 
  (it >= "10.10.0.1" and it <= "10.10.0.255")
  or 
  (it >= "10.20.0.1" and it <= "10.20.0.255")
) of registration address of client

Just swap the IP’s for the starts and ends of the ranges you’re hoping to cover.

1 Like
6

Thanks William, Understood. Have a wonderful day.

7

Technically speaking there is no way to define a single line statement to check for the following range if I can define something like Range|192.168.0.0/16?

|Network Range|192.168.0.0 - 192.168.255.255|
|Usable Host IP Range|192.168.0.1 - 192.168.255.254|

8

I’m not sure what issue you’re seeing? You can use wider address ranges, you’re not limited to the last octet…

Q: exists (ipv4 address "192.168.10.128") whose (it > "192.168.1.0" and it < "192.168.255.255")
A: True
T: 987

Q: exists (ipv4 address "192.168.10.128") whose (it > "192.168.11.0" and it < "192.168.255.255")
A: False
T: 1026
9

Thanks Jason, you gave me a good hint. I changed it to the following statement to cover entire 169.254.0.0/16. It seems to work for me at least from one server.

(it >= “169.254.0.0” and it <= “169.254.255.255”) of registration address of client

This is exactly I am looking for to cover wider address ranges within 169.254.x.x subnet.

2 Likes