How does cidrmatch work?

[danielbb]

The following code -

| eval ipa="10.22.3.2" 
| eval ret=if(cidrmatch("10.0.0.0/8", ipa), "tr", "fl") 
| return ret

Returns -

Why is that?

[harsmarvania57 · Accepted solution]

It is correct, because IP 10.22.3.2 belongs to CIDR Range 10.0.0.0/8 -> 10.0.0.0-10.255.255.255

[danielbb]

Very kind @harsmarvania57 - please convert to an answer...

[danielbb]

Ok,

by adding the makeresults

| makeresults
| eval ipa="10.22.3.2" 
| eval ret=if(cidrmatch("10.0.0.0/8", ipa), "tr", "fl")
| return ret

I get ret="tr".

Not sure whether ret="tr" is correct...