RWSETINTERSECT(1)

NAME
rwsetintersect - Perform intersection operations on IPset files

SYNOPSIS
  rwsetintersect  --add-set=IPSET_FILE
        [--add-set=IPSET_FILE...] [--remove-set=IPSET_FILE...]
        [--compression-method=COMP_METHOD]
        {--print-ips | --integer-ips | --set-file=IPSET_FILE}

DESCRIPTION
Note: It is recommended that you use rwsettool in place of rwsetintersect.

rwsetintersect takes multiple binary IPset files and intersects them, generating a new IPset which can be saved in a binary IPset file or written to the standard output when the standard output is not connected to a terminal. An output destination must be specified.

The IPset files are specified as either --add-set or --remove-set; at least one --add-set IPset must be specified.

First, rwsetintersect performs the intersection of all specified --add-set files. From the resulting IPset, rwsetintersect then removes all addresses specified in the --remove-set files.

rwsetintersect uses binary IPset files, not SiLK Flow data.

OPTIONS
Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--add-set=IPSET_FILE
    Specifies an intersection add file. At the minimum, one add file must be specified. Use "stdin" to read a binary IPset from the standard input.

--remove-set=IPSET_FILE
    Specifies an intersection remove file. Remove files are optional. Use "stdin" to read a binary IPset from the standard input.

--compression-method=COMP_METHOD
    Set the compression method of the output to COMP_METHOD. Some SiLK tools can use an external library to compress their binary output. The list of available compression methods and the default method are set when SiLK is compiled (the --help and --version switches print the available and default compression methods) and depend on which supported libraries are found. SiLK can support:

    none
        Do not compress the output using an external library

    zlib
        Use the zlib(3) library for compressing the output

    lzo1x
        Use the lzo1x algorithm from the LZO real time compression library for compression

    best
        Use whichever available method gives the "best" compression in general, though not necessarily the "best" for this particular output.

One of the following output switches is required; multiple switches may be specified:

--print-ips
    Print the resulting IP addresses to the standard output.

--integer-ips
    Enable the --print-ips option, but print the IPs as integers instead of as dotted decimal.

--set-file=IPSET_FILE
    Write the IP addresses to a binary IPset file named IPSET_FILE. Use "stdout" to write the IPset to the standard output.

EXAMPLES
rwsetintersect uses add-sets and remove-sets. An add-set IPset is intersected in the normal fashion, while a remove-set's negation is intersected.

For example, assume the following sets A,B,C,D:

  A = {1,2,3,4}
  B = {2,3,4,5}
  C = {3,4,5,6}
  D = {8,9,10,11}

then:

  A /\ B
      --add-set=A --add-set=B would result in {2,3,4}

  A /\ C
      --add-set=A --add-set=C would result in {3,4}

  A /\ D
      --add-set=A --add-set=D would result in {}

  A /\ ~D
      --add-set=A --remove-set=D would result in {1,2,3,4}

  A /\ ~A
      --add-set=A --remove-set=A would result in {}

  B /\ ~A
      --add-set=B --remove-set=A would result in {5}

  A /\ ~B
      --add-set=A --remove-set=B would result in {1}

SEE ALSO
rwsettool(1), rwset(1), rwsetbuild(1), rwsetcat(1)

NOTES
All --add-set operations are performed first, followed by all --remove-set operations.

rwsettool supersedes rwsetintersect. Modify your use of rwsetintersect as follows:

  Change:
    rwsetintersect --add=SET1 --add=SET2 --set-file=DEST_SET
  To:
    rwsettool --intersect --output=DEST_SET SET1 SET2

  Change:
    rwsetintersect --add=SET1 --add=SET2 --print-ips
  To:
    rwsettool --intersect SET1 SET2 | rwsetcat

  Change:
    rwsetintersect --add=SET1 --remove=SET2 --set-file=DEST_SET
  To:
    rwsettool --difference --output=DEST_SET SET1 SET2

  Change:
    rwsetintersect --add=SET1 --remove=SET2 --print-ips
  To:
    rwsettool --difference SET1 SET2 | rwsetcat

  Change:
    rwsetintersect --add=SET1 --add=SET2 --remove=SET3 \
        --set-file=DEST_SET
  To:
    rwsettool --intersect SET1 SET2 \
        | rwsettool --difference --output=DEST_SET stdin SET3