ipv4_netmask_suffix()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns the value of the IPv4 netmask suffix from an IPv4 string address.

Syntax

ipv4_netmask_suffix(ip)

Learn more about syntax conventions.

Parameters

Name Type Required Description
ip string ✔️ An expression representing an IPv4 address. IPv4 strings can be masked using IP-prefix notation.

IP-prefix notation

IP-prefix notation (also known as CIDR notation) is a concise way of representing an IP address and its associated network mask. The format is <base IP>/<prefix length>, where the prefix length is the number of leading 1 bits in the netmask. The prefix length determines the range of IP addresses that belong to the network.

For IPv4, the prefix length is a number between 0 and 32. So the notation 192.168.2.0/24 represents the IP address 192.168.2.0 with a netmask of 255.255.255.0. This netmask has 24 leading 1 bits, or a prefix length of 24.

For IPv6, the prefix length is a number between 0 and 128. So the notation fe80::85d:e82c:9446:7994/120 represents the IP address fe80::85d:e82c:9446:7994 with a netmask of ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00. This netmask has 120 leading 1 bits, or a prefix length of 120.

Returns

  • The value of the netmask suffix the IPv4 address. If the suffix isn't present in the input, a value of 32 (full netmask suffix) is returned.
  • null: If parsing the input as an IPv4 address string wasn't successful.

Example: Resolve IPv4 mask suffix

datatable(ip_string:string)
[
 '10.1.2.3',
 '192.168.1.1/24',
 '127.0.0.1/16',
]
| extend cidr_suffix = ipv4_netmask_suffix(ip_string)

Output

ip_string cidr_suffix
10.1.2.3 32
192.168.1.1/24 24
127.0.0.1/16 16

Related content