ipv6_compare()
Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Compares two IPv6 or IPv4 network address strings. The two IPv6 strings are parsed and compared while accounting for the combined IP-prefix mask calculated from argument prefixes, and the optional prefix
argument.
Note
The function can accept and compare arguments representing both IPv6 and IPv4 network addresses. However, if the caller knows that arguments are in IPv4 format, use ipv4_is_compare() function. This function will result in better runtime performance.
Syntax
ipv6_compare(
ip1,
ip2[ ,
prefix])
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
ip1, ip2 | string |
✔️ | An expression representing an IPv6 or IPv4 address. IPv6 and IPv4 strings can be masked using IP-prefix notation. |
prefix | int |
An integer from 0 to 128 representing the number of most significant bits that are taken into account. |
IP-prefix notation
IP-prefix notation (also known as CIDR notation) is a concise way of representing an IP address and its associated network mask. The format is <base IP>/<prefix length>
, where the prefix length is the number of leading 1 bits in the netmask. The prefix length determines the range of IP addresses that belong to the network.
For IPv4, the prefix length is a number between 0 and 32. So the notation 192.168.2.0/24 represents the IP address 192.168.2.0 with a netmask of 255.255.255.0. This netmask has 24 leading 1 bits, or a prefix length of 24.
For IPv6, the prefix length is a number between 0 and 128. So the notation fe80::85d:e82c:9446:7994/120 represents the IP address fe80::85d:e82c:9446:7994 with a netmask of ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00. This netmask has 120 leading 1 bits, or a prefix length of 120.
Returns
0
: If the long representation of the first IPv6 string argument is equal to the second IPv6 string argument.1
: If the long representation of the first IPv6 string argument is greater than the second IPv6 string argument.-1
: If the long representation of the first IPv6 string argument is less than the second IPv6 string argument.null
: If conversion for one of the two IPv6 strings wasn't successful.
Examples: IPv6/IPv4 comparison equality cases
Compare IPs using the IP-prefix notation specified inside the IPv6/IPv4 strings
datatable(ip1_string:string, ip2_string:string)
[
// IPv4 are compared as IPv6 addresses
'192.168.1.1', '192.168.1.1', // Equal IPs
'192.168.1.1/24', '192.168.1.255', // 24 bit IP4-prefix is used for comparison
'192.168.1.1', '192.168.1.255/24', // 24 bit IP4-prefix is used for comparison
'192.168.1.1/30', '192.168.1.255/24', // 24 bit IP4-prefix is used for comparison
// IPv6 cases
'fe80::85d:e82c:9446:7994', 'fe80::85d:e82c:9446:7994', // Equal IPs
'fe80::85d:e82c:9446:7994/120', 'fe80::85d:e82c:9446:7998', // 120 bit IP6-prefix is used for comparison
'fe80::85d:e82c:9446:7994', 'fe80::85d:e82c:9446:7998/120', // 120 bit IP6-prefix is used for comparison
'fe80::85d:e82c:9446:7994/120', 'fe80::85d:e82c:9446:7998/120', // 120 bit IP6-prefix is used for comparison
// Mixed case of IPv4 and IPv6
'192.168.1.1', '::ffff:c0a8:0101', // Equal IPs
'192.168.1.1/24', '::ffff:c0a8:01ff', // 24 bit IP-prefix is used for comparison
'::ffff:c0a8:0101', '192.168.1.255/24', // 24 bit IP-prefix is used for comparison
'::192.168.1.1/30', '192.168.1.255/24', // 24 bit IP-prefix is used for comparison
]
| extend result = ipv6_compare(ip1_string, ip2_string)
Output
ip1_string | ip2_string | result |
---|---|---|
192.168.1.1 | 192.168.1.1 | 0 |
192.168.1.1/24 | 192.168.1.255 | 0 |
192.168.1.1 | 192.168.1.255/24 | 0 |
192.168.1.1/30 | 192.168.1.255/24 | 0 |
fe80::85d:e82c:9446:7994 | fe80::85d:e82c:9446:7994 | 0 |
fe80::85d:e82c:9446:7994/120 | fe80::85d:e82c:9446:7998 | 0 |
fe80::85d:e82c:9446:7994 | fe80::85d:e82c:9446:7998/120 | 0 |
fe80::85d:e82c:9446:7994/120 | fe80::85d:e82c:9446:7998/120 | 0 |
192.168.1.1 | ::ffff:c0a8:0101 | 0 |
192.168.1.1/24 | ::ffff:c0a8:01ff | 0 |
::ffff:c0a8:0101 | 192.168.1.255/24 | 0 |
::192.168.1.1/30 | 192.168.1.255/24 | 0 |
Compare IPs using IP-prefix notation specified inside the IPv6/IPv4 strings and as additional argument of the ipv6_compare()
function
datatable(ip1_string:string, ip2_string:string, prefix:long)
[
// IPv4 are compared as IPv6 addresses
'192.168.1.1', '192.168.1.0', 31, // 31 bit IP4-prefix is used for comparison
'192.168.1.1/24', '192.168.1.255', 31, // 24 bit IP4-prefix is used for comparison
'192.168.1.1', '192.168.1.255', 24, // 24 bit IP4-prefix is used for comparison
// IPv6 cases
'fe80::85d:e82c:9446:7994', 'fe80::85d:e82c:9446:7995', 127, // 127 bit IP6-prefix is used for comparison
'fe80::85d:e82c:9446:7994/127', 'fe80::85d:e82c:9446:7998', 120, // 120 bit IP6-prefix is used for comparison
'fe80::85d:e82c:9446:7994/120', 'fe80::85d:e82c:9446:7998', 127, // 120 bit IP6-prefix is used for comparison
// Mixed case of IPv4 and IPv6
'192.168.1.1/24', '::ffff:c0a8:01ff', 127, // 127 bit IP6-prefix is used for comparison
'::ffff:c0a8:0101', '192.168.1.255', 120, // 120 bit IP6-prefix is used for comparison
'::192.168.1.1/30', '192.168.1.255/24', 127, // 120 bit IP6-prefix is used for comparison
]
| extend result = ipv6_compare(ip1_string, ip2_string, prefix)
Output
ip1_string | ip2_string | prefix | result |
---|---|---|---|
192.168.1.1 | 192.168.1.0 | 31 | 0 |
192.168.1.1/24 | 192.168.1.255 | 31 | 0 |
192.168.1.1 | 192.168.1.255 | 24 | 0 |
fe80::85d:e82c:9446:7994 | fe80::85d:e82c:9446:7995 | 127 | 0 |
fe80::85d:e82c:9446:7994/127 | fe80::85d:e82c:9446:7998 | 120 | 0 |
fe80::85d:e82c:9446:7994/120 | fe80::85d:e82c:9446:7998 | 127 | 0 |
192.168.1.1/24 | ::ffff:c0a8:01ff | 127 | 0 |
::ffff:c0a8:0101 | 192.168.1.255 | 120 | 0 |
::192.168.1.1/30 | 192.168.1.255/24 | 127 | 0 |
Related content
- Overview of IPv4/IPv6 functions