Lookup Definition IPV6 CIDR matching

[jhrac]

Hello,

We have created lookup definitions that use CIDR matching for IPV4 ips and is working as expected.  We are running into issues with IPV6.

We are trying to create a lookup definition that does a CIDR lookup on a IPV6 IP.  The lookup file uses CIDR notation.  One example from the file is:

2a02:4780:10::/44

The IP that should match is:

2a02:4780:10:5be5::1

The lookup definition is:

CIDR(network)

Are IPV6 CIDR lookups supported?  If not, how can we do the lookup definition to satisfy the requrement? 

[bowesmana · Accepted solution]

Are you saying it doesn't work?

This works fine

| makeresults
| fields - _time
| eval network="2a02:4780:10::/44"
| outputlookup ipv6.csv

and

| makeresults
| fields - _time
| eval ipv6="2a02:4780:10:5be5::1"
| lookup ipv6 network as ipv6 OUTPUT network  as v6IP

where the match type is defined as CIDR(network)

[bowesmana]

My understanding is that IPv6 IS supported, but I do recall I may have had some issues with CIDR on IPv6. Can you test

| makeresults
| eval ipv6="2a02:4780:10:5be5::1"
| search ipv6="2a02:4780:10::/44"

because search definitely should support CIDR in ipv6