topic Lookup Definition IPV6 CIDR matching in Other Usage

Lookup Definition IPV6 CIDR matching

jhrac — Tue, 02 Jul 2024 19:50:14 GMT

Hello,

We have created lookup definitions that use CIDR matching for IPV4 ips and is working as expected. We are running into issues with IPV6.

We are trying to create a lookup definition that does a CIDR lookup on a IPV6 IP. The lookup file uses CIDR notation. One example from the file is:

2a02:4780:10::/44

The IP that should match is:

2a02:4780:10:5be5::1

The lookup definition is:

CIDR(network)

Are IPV6 CIDR lookups supported? If not, how can we do the lookup definition to satisfy the requrement?

bowesmana — Wed, 03 Jul 2024 00:00:07 GMT

My understanding is that IPv6 IS supported, but I do recall I may have had some issues with CIDR on IPv6. Can you test

| makeresults | eval ipv6="2a02:4780:10:5be5::1" | search ipv6="2a02:4780:10::/44"

because search definitely should support CIDR in ipv6

bowesmana — Wed, 03 Jul 2024 00:57:26 GMT

Are you saying it doesn't work?

This works fine

| makeresults | fields - _time | eval network="2a02:4780:10::/44" | outputlookup ipv6.csv

and

| makeresults | fields - _time | eval ipv6="2a02:4780:10:5be5::1" | lookup ipv6 network as ipv6 OUTPUT network as v6IP

where the match type is defined as CIDR(network)