ipv6_is_in_any_range

This page explains how to use the ipv6_is_in_any_range function in APL.

Use the ipv6_is_in_any_range function to determine whether a given IPv6 address belongs to any of a specified set of IPv6 CIDR ranges. This function is particularly useful in log enrichment, threat detection, and network analysis tasks that involve validating or filtering IP addresses against allowlists or blocklists.

You can use this function to:

• Detect whether traffic originates from known internal or external networks.
• Match IPv6 addresses against predefined address ranges for compliance or security auditing.
• Filter datasets based on whether requesters fall into allowed or disallowed IP zones.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

Splunk doesn’t offer a built-in function that directly checks if an IP falls within a list of CIDR ranges. Typically, SPL users must write custom logic using cidrmatch() repeatedly or rely on lookup tables.

Splunk example

| eval is_internal = if(cidrmatch("2001:db8::/32", ip), "true", "false")

ANSI SQL users

ANSI SQL doesn’t natively support IPv6-aware CIDR range checks. Such functionality usually requires user-defined functions or external extensions.

SQL example

-- Typically handled via stored procedures or UDFs in extended SQL environments
SELECT ip, is_in_range(ip, '2001:db8::/32') FROM traffic_logs

Usage

Syntax

ipv6_is_in_any_range(ipv6_address, ipv6_ranges)

Parameters

Name	Type	Description
ipv6_address	string	An IPv6 address in standard format (e.g., 2001:db8::1).
ipv6_ranges	dynamic array	A JSON array of IPv6 CIDR strings to compare against.

Returns

A bool value:

• true if the given IPv6 address is within any of the provided CIDR ranges.
• false otherwise.

Example

You want to detect HTTP requests from a specific internal IPv6 block.

Query

['sample-http-logs']
| extend inRange = ipv6_is_in_any_range('2001:db8::1234', dynamic(['2001:db8::/32', 'fd00::/8']))
| project _time, uri, method, status, inRange

Run in Playground

Output

_time	uri	method	status	inRange
2025-06-30T01:00:00Z	/api/login	POST	200	true
2025-06-30T01:01:00Z	/healthcheck	GET	204	true

List of related functions

• ipv4_is_in_any_range: Use this function when working with IPv4 addresses instead of IPv6.
• ipv6_compare: Compares two IPv6 addresses. Use this for sorting or deduplication rather than range matching.
• ipv6_is_match: Checks whether an IPv6 address matches a specific range. Use this if you need to test against a single CIDR block.