Discussing the switch to select only IPv4 or IPv6 alarms feature in Global Report V2

[mohamedawnallah]

@romain-fontugne I'd like to discuss the handling of IPv4 and IPv6 in Grip and IODA Alarms. Presently, there is no support for specifying the IP Address Family in both Grip and IODA Alarms. To address this, we have two potential solutions:

1. Integrate Address Family Type in our networks API endpoint: This approach is relatively quick to implement and well within our control.

2. Request Grip and IODA's team to add Address Family Type in their API response: This alternative will take more time, and we have less control over it.

Currently, we have managed to integrate IPv4 and IPv6 filtering into our IHR Alarms (after fully discussing Which ASN IP Address Family is associated with in Hegemony Alarms?). However, when choosing Grip or IODA Alarms, the absence of an IP Address Family attribute can lead to misleading results. In my humble opinion, I believe that this feature is closely tied to the integration of IP Address Family in both IODA and Grip Alarms.

Let's discuss how to proceed with this and gather opinions on the best course of action.

Looking forward to hearing your thoughts and suggestions.

[romain-fontugne]

I believe IODA is only reporting for IPv4, so we could just ignore IODA for IPv6.
For GRIP, I'm not sure, I have to check the results we get from their API (but I cannot check now, it looks like the GRIP website is down)

[mohamedawnallah]

Yeah occasionally the website of grip goes down but their APIs are still up you can see the response here for example:
https://api.grip.inetintel.cc.gatech.edu/json/events?length=10&start=0&ts_start=2023-09-18T15%3A08&ts_end=2023-09-19T15%3A08&min_susp=0&max_susp=20&event_type=moas

[romain-fontugne]

thanks! so we can distinguish IPv4 and IPv6 alarms by looking at the prefix' field in the alarms. If the prefix contains .it is an IPv4 alarms (e.g. 177.155.191.0/24) if it contains:` it is an IPv6 alarm.

Now, I don't see any IPv6 prefixes in the alarms returned from the above link, so it is possible that they don't do IPv6.

[mohamedawnallah]

Thanks! I didn't pay much attention to detecting the IP address family from the IP Prefix field. Your explanation clarifies it for me