incidr6

Use the `incidr6()` function to determine if an IPv6 address falls within one or more specified Classless Inter-Domain Routing (CIDR) blocks.

## Syntax

```sql
incidr6 (<ipv6_address_field>, "<cidr6_range1>[, <cidr6_range2>...]")
```

## Parameters

| Name | Type | Required | Description |
| -------------------- | ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ipv6_address_field` | string, ip | Yes | The IPv6 address field (or explicit string literal) to evaluate. |
| `cidr6_range` | string | Yes | One or more IPv6 CIDR ranges, provided as a comma-separated string enclosed in double quotes (for example, `"2001:db8::/32"` or `"2001:db8::/32, 2001:db8:cafe::/48"`). |

## Returns

The `incidr6()` function returns a boolean value (`true` or `false`). The function returns `true` if the address falls within any of the defined ranges, and `false` otherwise.

## Usage notes

* This function is designed specifically for IPv6 addresses. Use `incidr()` for IPv4 addresses.
* The first parameter must contain an IPv6 address contained in an IPv6 field. For production purposes, this IPv6 address will normally be carried in a field that you retrieve from a dataset. For manual usage, assign the IPv6 address to a field, and then use that field with this function.
* When multiple CIDR ranges are provided in the second parameter (separated by commas), the function applies a logical **OR** operation. If the IPv6 address matches any of the listed ranges, the function returns `true`.
* This function is commonly used within the `filter` stage to narrow down results based on network segments or specific IP ranges.

## Examples

### Example 1: Check against a single IPv6 CIDR

**Goal**: Filter for records where the `ipv6_address` falls within a specific `/32` global unicast CIDR block.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv6_address incidr6("2001:0db8::/32") 
| fields event_id, ipv6_address 
| limit 5 
```

**Explanation**: The query evaluates the `ipv6_address` field for each record. The query returns only those records where the address (for example, `2001:0db8::1`) falls within the `2001:0db8::/32` range.

**Output**:

| EVENT\_ID | IPV6\_ADDRESS |
| --------- | -------------------- |
| 103 | 2001:0db8::1 |
| 107 | 2001:0db8:cafe::1 |
| 109 | 2001:0db8:1234::abcd |

### Example 2: Check against multiple IPv6 CIDRs

**Goal**: Filter for records where the `ipv6_address` falls within _either_ of the specified IPv6 CIDR ranges.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv6_address incidr6("2001:0db8:cafe::/48, 2001:0db8:1234::/48") 
| fields event_id, ipv6_address 
| limit 5 
```

**Explanation**: The query uses a comma-separated list of CIDRs. The query returns records where the `ipv6_address` matches either the first range (`2001:0db8:cafe::/48`) OR the second range (`2001:0db8:1234::/48`). Event ID 107 matches the first, and Event ID 109 matches the second.

**Output**:

| EVENT\_ID | IPV6\_ADDRESS |
| --------- | -------------------- |
| 107 | 2001:0db8:cafe::1 |
| 109 | 2001:0db8:1234::abcd |

## Related articles

* **Stages**: [`filter`](../stages/filter)
* **Functions**: [`incidr`](incidr), [`incidrlist`](incidrlist)