Convert community-id into BPF or original 5 tuple

corelight / pycommunityid

A Python implementation of the Community ID flow hashing standard

BSD 3-Clause "New" or "Revised" License

23 stars 10 forks source link

Convert community-id into BPF or original 5 tuple #1

Closed swish-cto closed 4 years ago

swish-cto commented 5 years ago

Desire a script which will convert a community-id into the following formats for use with systems which don't support a community-id:

Berkeley Packet Filter expression
original 5 tuple

ckreibich commented 4 years ago

Interesting request, thank you. The current version of Community ID isn't reversible — you cannot go from the hash back to the input tuple. That was by design, though I can see why this would be handy. I'll add a note to the spec itself at https://github.com/corelight/community-id-spec as a feature request, linking to yours, and close this one.

(Apologies for the glacial response time!)