Reputation: 2188
IP addresses are stored in my db (I have not control over this) as int8, not inet. I know how to work around this when I query using psql.
For example, using psql if I query as so I get the int8 answer back.;
SELECT ip_src, ip_dst from iphdr ;
ip_src | ip_dst
------------+------------
2886730039 | 2887777037
But if I use '0.0.0.0'::inet + ip_src as ipsrc,'0.0.0.0'::inet + ip_dst as ipdst I get the ip addresses;
SELECT '0.0.0.0'::inet + ip_src as ipsrc,'0.0.0.0'::inet + ip_dst as ipdst from iphdr ;
ipsrc | ipdst
-----------------+----------------
172.16.1.55 | 172.31.251.13
This may help show you how I'm querying the addresses.
In my application_helper I have;
def get_attacker_ip(sid)
IpsIphdr.where('sid =?', sid).first.ip_src
end
def get_target_ip(sid)
IpsIphdr.where('sid =?', sid).first.ip_dst
end
In my controller;
def ips_dashboard
@event = IpsEvent.find 1, 7
end
In my view;
<th>Timestamp</th>
<th>Sensor Name</th>
<th>Signature Name</th>
<th>Signature Class</th>
<th>Attacker</th>
<th>Target</th>
</tr>
<tr>
<td class='timestamp'><%= @event.timestamp %></td>
<td class='sensor_name'><%= get_hostname(@event.sid) %></td>
<td class='sig_name'><%= get_sig_name(@event.signature) %></td>
<td class='sig_class'><%= get_sig_class_id(@event.signature) %></td>
<td class='attacker'><%= get_attacker_ip(@event.sid) %></td>
<td class='target'><%= get_target_ip(@event.sid) %></td>
</tr>
</table>
Upvotes: 2
Views: 267
Reputation: 2741
get_attacker_ip(@event.sid).
to_s(16). # convert to hex
rjust(8, '0'). # pad with leading zeroes
scan(/.{2}/). # split into 2-char chunks
map(&:hex). # convert each chunk to base-10
join('.') # join with dots
Upvotes: 2