ipv4_netmask_suffix

This function is useful for network log analysis, security auditing, and infrastructure monitoring. It helps you categorize IP addresses by their subnets, enabling you to detect patterns or anomalies in network traffic or to manage IP allocations effectively.

Usage#

Syntax#

ipv4_netmask_suffix(ipv4address)

Parameters#

Parameter	Type	Description
`ipv4address`	string	The IPv4 address in CIDR notation (for example, `192.168.1.1/24`).

Returns#

Returns an integer representing the netmask suffix. For example, 24 for 192.168.1.1/24.
Returns the value 32 when the input IPv4 address doesn’t contain the suffix.
Returns null if the input isn’t a valid IPv4 address in CIDR notation.

Use case example#

When analyzing network traffic logs, you can extract the netmask suffix to group or filter traffic by subnets.

Query

['sample-http-logs']
| extend netmask = ipv4_netmask_suffix('192.168.1.1/24')

Run in Playground

Output

geo.country	netmask
USA	24
UK	24

ipv4_compare: Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
ipv4_is_in_range: Checks if an IP address is within a specified range.
ipv4_is_private: Checks if an IPv4 address is within private IP ranges.
parse_ipv4: Converts a dotted-decimal IP address into a numeric representation.

Other query languages#

Splunk SPL users

In Splunk, netmask suffix extraction typically requires manual parsing or custom scripts. In APL, the ipv4_netmask_suffix function simplifies this task by directly extracting the suffix from an IPv4 address in CIDR notation.

Splunk example

eval netmask = replace(ip, "^.*?/", "")

APL equivalent

extend netmask = ipv4_netmask_suffix(ip)

ANSI SQL users

In ANSI SQL, extracting the netmask suffix often involves using string functions like SUBSTRING or CHARINDEX. In APL, the ipv4_netmask_suffix function provides a direct and efficient alternative.

SQL example

SELECT SUBSTRING(ip, CHARINDEX('/', ip) + 1, LEN(ip)) AS netmask FROM logs;