CERT/CC
background
background
CERT NetSA Security Suite 
Open Source Tools for Network Monitoring 
News | Downloads | Documentation | Wiki | Tooltips
SiLK 2.1.0 | YAF 1.0.0.2 | IPA 0.4.0 | fixbuf 0.8.0 | Portal 0.9.0 | RAVE 1.9.16 | iSiLK 0.1.6
IPA - Documentation
Documentation | Downloads | Release Notes

ipa-sql

The ipa-sql schema defines the tables, indices, and stored procedures for accessing IPA data.

The schema requires PostgreSQL 8.0 or higher, with the IP4R extension installed.

Installation

Detailed installation instructions for the IPA database schema are available in sql/README within the IPA distribution archive.

Design

The IPA data model maps IP address ranges to any number of user-defined attributes. Because these attribute mappings often change over time, IPA allows users to associate groups of these mappings with a specific time period. This facilitates retrospective analysis of network data based on how addresses were labeled during the time period in question.

Here is the entity-relationship diagram for IPA.

ipa_schema.png

IPA Entity Relationship Diagram

Within an IPA data store, addresses and labels are grouped into logical partitions called catalogs. Within each catalog, clients import one or more datasets, which are collections of IPA records that are valid during a given time period. Each of these datasets contains one or more associations, which are the observed IP addresses, along with any labels or values, depending on the catalog type.

IPA presently supports the following catalog types:

The assoc table pictured above is actually an updateable view, not a physical table. Data logically added to the assoc view will be inserted into either the assoc_set, assoc_bag, assoc_pmap, or assoc_mmap tables, depending on the structure of the data itself.