ipv6_is_match()

Article
09/11/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Matches two IPv6 or IPv4 network address strings. The two IPv6/IPv4 strings are parsed and compared while accounting for the combined IP-prefix mask calculated from argument prefixes, and the optional prefix argument.

Note

The function can accept and compare arguments representing both IPv6 and IPv4 network addresses. If the caller knows that arguments are in IPv4 format, use the ipv4_is_match() function. This function will result in better runtime performance.

Syntax

ipv6_is_match(ip1,ip2[ ,prefix])

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
ip1, ip2	`string`	✔️	An expression representing an IPv6 or IPv4 address. IPv6 and IPv4 strings can be masked using IP-prefix notation.
prefix	`int`		An integer from 0 to 128 representing the number of most-significant bits that are taken into account.

IP-prefix notation

IP-prefix notation (also known as CIDR notation) is a concise way of representing an IP address and its associated network mask. The format is <base IP>/<prefix length>, where the prefix length is the number of leading 1 bits in the netmask. The prefix length determines the range of IP addresses that belong to the network.

For IPv4, the prefix length is a number between 0 and 32. So the notation 192.168.2.0/24 represents the IP address 192.168.2.0 with a netmask of 255.255.255.0. This netmask has 24 leading 1 bits, or a prefix length of 24.

For IPv6, the prefix length is a number between 0 and 128. So the notation fe80::85d:e82c:9446:7994/120 represents the IP address fe80::85d:e82c:9446:7994 with a netmask of ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00. This netmask has 120 leading 1 bits, or a prefix length of 120.

Returns

true: If the long representation of the first IPv6/IPv4 string argument is equal to the second IPv6/IPv4 string argument.
false: Otherwise.
null: If conversion for one of the two IPv6/IPv4 strings wasn't successful.

Examples

IPv6/IPv4 comparison equality case - IP-prefix notation specified inside the IPv6/IPv4 strings

Run the query

datatable(ip1_string:string, ip2_string:string)
[
 // IPv4 are compared as IPv6 addresses
 '192.168.1.1',    '192.168.1.1',       // Equal IPs
 '192.168.1.1/24', '192.168.1.255',     // 24 bit IP4-prefix is used for comparison
 '192.168.1.1',    '192.168.1.255/24',  // 24 bit IP4-prefix is used for comparison
 '192.168.1.1/30', '192.168.1.255/24',  // 24 bit IP4-prefix is used for comparison
  // IPv6 cases
 'fe80::85d:e82c:9446:7994', 'fe80::85d:e82c:9446:7994',         // Equal IPs
 'fe80::85d:e82c:9446:7994/120', 'fe80::85d:e82c:9446:7998',     // 120 bit IP6-prefix is used for comparison
 'fe80::85d:e82c:9446:7994', 'fe80::85d:e82c:9446:7998/120',     // 120 bit IP6-prefix is used for comparison
 'fe80::85d:e82c:9446:7994/120', 'fe80::85d:e82c:9446:7998/120', // 120 bit IP6-prefix is used for comparison
 // Mixed case of IPv4 and IPv6
 '192.168.1.1',      '::ffff:c0a8:0101', // Equal IPs
 '192.168.1.1/24',   '::ffff:c0a8:01ff', // 24 bit IP-prefix is used for comparison
 '::ffff:c0a8:0101', '192.168.1.255/24', // 24 bit IP-prefix is used for comparison
 '::192.168.1.1/30', '192.168.1.255/24', // 24 bit IP-prefix is used for comparison
]
| extend result = ipv6_is_match(ip1_string, ip2_string)

Output

ip1_string	ip2_string	result
192.168.1.1	192.168.1.1	1
192.168.1.1/24	192.168.1.255	1
192.168.1.1	192.168.1.255/24	1
192.168.1.1/30	192.168.1.255/24	1
fe80::85d:e82c:9446:7994	fe80::85d:e82c:9446:7994	1
fe80::85d:e82c:9446:7994/120	fe80::85d:e82c:9446:7998	1
fe80::85d:e82c:9446:7994	fe80::85d:e82c:9446:7998/120	1
fe80::85d:e82c:9446:7994/120	fe80::85d:e82c:9446:7998/120	1
192.168.1.1	::ffff:c0a8:0101	1
192.168.1.1/24	::ffff:c0a8:01ff	1
::ffff:c0a8:0101	192.168.1.255/24	1
::192.168.1.1/30	192.168.1.255/24	1

IPv6/IPv4 comparison equality case- IP-prefix notation specified inside the IPv6/IPv4 strings and as additional argument of the `ipv6_is_match()` function