When there are lots of results, it might be interesting to group not by individual (sip, dip) pairs, but rather which networks communicate with each other.
DoD:
- enable this aggregation (instead of printing
sip, dip, use dnet and snet)
Requires:
- drilling into the Attribute nodes
- make sure that snet and dnet can use different masks
Ideas:
snet/24 and dnet/29 in the attributes section of a query
When there are lots of results, it might be interesting to group not by individual (sip, dip) pairs, but rather which networks communicate with each other.
DoD:
sip,dip, usednetandsnet)Requires:
Ideas:
snet/24anddnet/29in the attributes section of a query