identify addresses in a subnet queue

I’ve got a ‘catch all’ queue at the bottom of my 400 deep simple queue list. I’m looking for a way to figure out what IP addresses are hitting that catch all queue to see who doesn’t have a queue setup. Doing it manually is a pain and it’s not very convenient to pull it to a linux box to sort.

Ideas?

Set its max-limit to 56k and see who complains? Lol

Seriously though maybe you could add a queue right before it and start narrowing the target IP range on the queue and follow the cases where changes cause the test queue to catch or miss traffic. Keep cutting the range in half with each new test and it should only take 8 tries for a /24.

I’m already pulling the accounting snapshot to get all the dst addresses and comparing those to my queues with some awk-fu. really like to see some routeros method to do it instead.

Awk-fu. LOL

Awk is an awesome tool.