#881·arkime

Feature Request: Subnet Grouping for Connections View

Author: mmgueroCreated Jul 19, 2018Updated May 26, 2026
Labelsenhancementviewer

For large networks with many hosts, the connections view can get cluttered. It would be useful to be able to specify a CIDR mask, something like "Src IP/24", "Dst IP/16", etc. for the "Field for the source/destination nodes" in the connections view. Then, the connections view could display which subnets are talking to each other, rather than just individual hosts.

I think you could possibly use Elasticsearch's IP Range Aggregation for this.

There would have to be some thought about how IPv6 would fit into it. I guess you could just scale the subnet mask up from 32 to 128 bits (eg., if they did Src IP/16 that would be equivalent to /64 for IPv6 addresses?).