Exceeding IPs in one list

kevin_thys — Fri, 16 Dec 2016 14:49:23 GMT

Hi,

The miner Ransomware IP has > 10000 so I'am wondering how I could solve this issue. Should have some output feed that you can define to take a certain amount of IP's so you can map that on your hardware. And then create a second output that is skippen a defined amount of IPs an creating output feed with next range of IPs

Something like:

miner => processor aggregator => output A en output B.

=> output A : IP = 1 - 5000

=> output B: IP = 5001 till 10000

...

Maybe any idea?

Regards,

Kevin

Re: Exceeding IPs in one list

ksteves1 — Fri, 16 Dec 2016 15:47:34 GMT

you can use QUERY_STRING on feed URL of s=start, n=num as discussed here:

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Confused-over-EBL-size-limit/m-p/104038/

topic Exceeding IPs in one list in General Topics

Exceeding IPs in one list

Re: Exceeding IPs in one list