ipv6_is_in_range()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Checks if an IPv6 string address is in the IPv6-prefix notation range.

Syntax

ipv6_is_in_range(Ipv6Address,Ipv6Range)

Learn more about syntax conventions.

Parameters

Name Type Required Description
Ipv6Address string ✔️ An expression representing an IPv6 address.
Ipv6Range string ✔️ An expression representing an IPv6 range using IP-prefix notation.

IP-prefix notation

IP-prefix notation (also known as CIDR notation) is a concise way of representing an IP address and its associated network mask. The format is <base IP>/<prefix length>, where the prefix length is the number of leading 1 bits in the netmask. The prefix length determines the range of IP addresses that belong to the network.

For IPv4, the prefix length is a number between 0 and 32. So the notation 192.168.2.0/24 represents the IP address 192.168.2.0 with a netmask of 255.255.255.0. This netmask has 24 leading 1 bits, or a prefix length of 24.

For IPv6, the prefix length is a number between 0 and 128. So the notation fe80::85d:e82c:9446:7994/120 represents the IP address fe80::85d:e82c:9446:7994 with a netmask of ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00. This netmask has 120 leading 1 bits, or a prefix length of 120.

Returns

  • true: If the long representation of the first IPv6 string argument is in range of the second IPv6 string argument.
  • false: Otherwise.
  • null: If conversion for one of the two IPv6 strings wasn't successful.

Example

datatable(ip_address:string, ip_range:string)
[
 'a5e:f127:8a9d:146d:e102:b5d3:c755:abcd',    'a5e:f127:8a9d:146d:e102:b5d3:c755:0000/112',
 'a5e:f127:8a9d:146d:e102:b5d3:c755:abcd',    'a5e:f127:8a9d:146d:e102:b5d3:c755:abcd',
 'a5e:f127:8a9d:146d:e102:b5d3:c755:abcd',    '0:0:0:0:0:ffff:c0a8:ac/60',
]
| extend result = ipv6_is_in_range(ip_address, ip_range)

Output

ip_address ip_range result
a5e:f127:8a9d:146d:e102:b5d3:c755:abcd a5e:f127:8a9d:146d:e102:b5d3:c755:0000/112 True
a5e:f127:8a9d:146d:e102:b5d3:c755:abcd a5e:f127:8a9d:146d:e102:b5d3:c755:abcd True
a5e:f127:8a9d:146d:e102:b5d3:c755:abcd 0:0:0:0:0:ffff:c0a8:ac/60 False