parse_ipv6_mask()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Converts IPv6/IPv4 string and netmask to a canonical IPv6 string representation.

Syntax

parse_ipv6_mask(ip, prefix)

Learn more about syntax conventions.

Parameters

IP-prefix notation

IP-prefix notation (also known as CIDR notation) is a concise way of representing an IP address and its associated network mask. The format is <base IP>/<prefix length>, where the prefix length is the number of leading 1 bits in the netmask. The prefix length determines the range of IP addresses that belong to the network.

For IPv4, the prefix length is a number between 0 and 32. So the notation 192.168.2.0/24 represents the IP address 192.168.2.0 with a netmask of 255.255.255.0. This netmask has 24 leading 1 bits, or a prefix length of 24.

For IPv6, the prefix length is a number between 0 and 128. So the notation fe80::85d:e82c:9446:7994/120 represents the IP address fe80::85d:e82c:9446:7994 with a netmask of ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00. This netmask has 120 leading 1 bits, or a prefix length of 120.

Returns

If conversion is successful, the result is a string representing a canonical IPv6 network address. If conversion isn't successful, the result is an empty string.

Example

datatable(ip_string: string, netmask: long)
[
    // IPv4 addresses
    '192.168.255.255', 120,  // 120-bit netmask is used
    '192.168.255.255/24', 124,  // 120-bit netmask is used, as IPv4 address doesn't use upper 8 bits
    '255.255.255.255', 128,  // 128-bit netmask is used
    // IPv6 addresses
    'fe80::85d:e82c:9446:7994', 128,     // 128-bit netmask is used
    'fe80::85d:e82c:9446:7994/120', 124, // 120-bit netmask is used
    // IPv6 with IPv4 notation
    '::192.168.255.255', 128,  // 128-bit netmask is used
    '::192.168.255.255/24', 128,  // 120-bit netmask is used, as IPv4 address doesn't use upper 8 bits
]
| extend ip6_canonical = parse_ipv6_mask(ip_string, netmask)

Output