incidr6 ↗

Use the incidr6() function to determine if an IPv6 address falls within one or more specified Classless Inter-Domain Routing (CIDR) blocks.

Syntax

incidr6 (<ipv6_address_field>, "<cidr6_range1>[, <cidr6_range2>...]")

Parameters

Name Type Required Description
ipv6_address_field string, ip Yes The IPv6 address field (or explicit string literal) to evaluate.
cidr6_range string Yes One or more IPv6 CIDR ranges, provided as a comma-separated string enclosed in double quotes (for example, "2001:db8::/32" or "2001:db8::/32, 2001:db8:cafe::/48").

Returns

The incidr6() function returns a boolean value (true or false). The function returns true if the address falls within any of the defined ranges, and false otherwise.

Usage notes

  • This function is designed specifically for IPv6 addresses. Use incidr() for IPv4 addresses.
  • The first parameter must contain an IPv6 address contained in an IPv6 field. For production purposes, this IPv6 address will normally be carried in a field that you retrieve from a dataset. For manual usage, assign the IPv6 address to a field, and then use that field with this function.
  • When multiple CIDR ranges are provided in the second parameter (separated by commas), the function applies a logical OR operation. If the IPv6 address matches any of the listed ranges, the function returns true.
  • This function is commonly used within the filter stage to narrow down results based on network segments or specific IP ranges.

Examples

Example 1: Check against a single IPv6 CIDR

Goal: Filter for records where the ipv6_address falls within a specific /32 global unicast CIDR block.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv6_address incidr6("2001:0db8::/32") 
| fields event_id, ipv6_address 
| limit 5

Explanation: The query evaluates the ipv6_address field for each record. The query returns only those records where the address (for example, 2001:0db8::1) falls within the 2001:0db8::/32 range.

Output:

EVENT_ID IPV6_ADDRESS
103 2001:0db8::1
107 2001:0db8:cafe::1
109 2001:0db8:1234::abcd

Example 2: Check against multiple IPv6 CIDRs

Goal: Filter for records where the ipv6_address falls within either of the specified IPv6 CIDR ranges.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv6_address incidr6("2001:0db8:cafe::/48, 2001:0db8:1234::/48") 
| fields event_id, ipv6_address 
| limit 5

Explanation: The query uses a comma-separated list of CIDRs. The query returns records where the ipv6_address matches either the first range (2001:0db8:cafe::/48) OR the second range (2001:0db8:1234::/48). Event ID 107 matches the first, and Event ID 109 matches the second.

Output:

EVENT_ID IPV6_ADDRESS
107 2001:0db8:cafe::1
109 2001:0db8:1234::abcd