Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

IP Intelligence

THE_BLUE
Cirrus
Cirrus

Hi,

how to export IP Intelligence database from F5 ?

is it possible to view all ip under each category? if yes then how ?

 

since the update is refreshed every five minutes , does this will affect the size of WAF or may cause any performance issue?

1 ACCEPTED SOLUTION

Hello Blue.

 

"so is it possible to check all ip under each category from portal?"

No, it's not possible. IP Reputation service is provided by an external company (brightcloud) and their bussiness lays on not disclousing this info.

 

"so there is no option to check the ip from GUI , i have to do all action from CLI, right?"

No, there is not. But you can check from internet at

https://www.brightcloud.com/tools/url-ip-lookup.php

 

"in regards to DB status, it mention how many ips has been added , but no details related to how many ip has been removed."

It's much common to include IP in the blacklist than remove them.

 

Please, don't forget to mark my answer as the best to help me for the contribution.

 

Regards,

Dario.

Regards,
Dario.

View solution in original post

4 REPLIES 4

Hello Blue.

The IPI DB is stored at /var/IpRep/F5IpRep.dat. I've never tried this before, but you can try to copy this file into a different device.

The DB is a hash table, where you can check the category of each IP using the next command.

iprep_lookup <X.X.X.X>

But there is no an inverse search to get all the IPs from each category.

The DB updates are composed by addresses that are included and removed. For this reason, you don't have to worry about the space.

Regards,

Dario.

Regards,
Dario.

Hi Dario,

i want to export the DB let say in cvs format for example to check all ips, but i think it is not possible.

so is it possible to check all ip under each category from portal?

so there is no option to check the ip from GUI , i have to do all action from CLI, right?

 

in regards to DB status, it mention how many ips has been added , but no details related to how many ip has been removed.

 

 

thanks

Hello Blue.

 

"so is it possible to check all ip under each category from portal?"

No, it's not possible. IP Reputation service is provided by an external company (brightcloud) and their bussiness lays on not disclousing this info.

 

"so there is no option to check the ip from GUI , i have to do all action from CLI, right?"

No, there is not. But you can check from internet at

https://www.brightcloud.com/tools/url-ip-lookup.php

 

"in regards to DB status, it mention how many ips has been added , but no details related to how many ip has been removed."

It's much common to include IP in the blacklist than remove them.

 

Please, don't forget to mark my answer as the best to help me for the contribution.

 

Regards,

Dario.

Regards,
Dario.

Dear Dario,

Thank you very much. Appreciate your support.