I’ve been racking my brain on this one, and the solution is probably so simple but I just can’t figure it out and have searched everywhere and can’t find a solution to this specific problem.
I’ve got two tables – one contains an IP connections list, for example:
Connections_Table
src dst
192.168.1.1 1.2.3.4
192.168.1.1 2.2.2.2
192.168.1.1 3.3.3.3
192.168.1.1 4.4.4.4
The other table contains a list of IP addresses, for example:
Bad_Ip_Addresses_Table
ip
7.8.9.4
3.2.1.4
77.8.99.4
2.2.2.2
18.7.9.8
Here’s where I can’t find how to build this query… I’m trying build a table that shows src and dst from the first table, and whether the 2nd table contains the dst from the first table. In other words:
Results_Table
src dst match
192.168.1.1 1.2.3.4 0
192.168.1.1 2.2.2.2 1
192.168.1.1 3.3.3.3 0
192.168.1.1 4.4.4.4 0
Here’s probably the biggest catch: I’ve seen posts on SO where the solution involves creating a table and triggers. I can’t do that – This would be an AWS Kinesis Analytics SQL statement:
Connections_Table is ingested live, and Bad_Ip_Addresses_Table is a CSV loaded from AWS S3. On each row ingested I need to perform a SQL statement against the CSV to find if the dst ip is in the CSV.
Any suggestions?
Solution:
- In MySQL, you can
Left JoinfromConnections_TabletoBad_Ip_Addresses_Table, such that alldstvalues fromConnections_Tableare considered (whether a matching row exists or not). - You can then
Group Byonsrcanddst; and useCount()function to count the matches. Note thatCount(null) = 0; so non-matching rows will return 0 (since there will benullvalues post the Left join).
In MySQL, try the following query:
SELECT
ct.src,
ct.dst,
COUNT(biat.ip) AS match
FROM
Connections_Table AS ct
LEFT JOIN Bad_Ip_Addresses_Table AS biat ON biat.ip = ct.dst
GROUP BY ct.src, ct.dst

