Prefix Preserving IP Anonymization

Elastic Stack Logstash
1

Is there any algorithm that preserves prefix property of IP?

2

I'm not sure what you mean. Could you give an example?

3

Ok. Suppose I have bunch of IP's having same network id like,
10.130.120.11
10.130.125.26
here netmask id 255.255.0.0
So after anonymization these should look like,
XXX.YYY.ssdasd.dasa
XXX.YYY.werew.wefw
Here I mean that NID should get same hash value. So after anonymization, I should able to figure out that these bunch of IPs belongs to same subet.

4

This sounds close to what the fingerprint filter does with method => "IPV4_NETWORK":

If set to IPV4_NETWORK the input data needs to be a IPv4 address and the hash value will be the masked-out address using the number of bits specified in the key option. For example, with "1.2.3.4" as the input and key set to 16, the hash becomes "1.2.0.0".

But you want to keep the last bits and hash those that match the network mask?

5

Yes, I want to hash NID and HID separately. So I can identify IP belonging to same network after anonymization also.

6

Sounds like a reasonable feature request to the fingerprint plugin, but for now you'll probably have to use a ruby filter and write some custom code.