Searching on IP Address Ranges

This topic describes how to search on IP address ranges.

CIDR notation works well for IPv4 addressing. For example:

netconn_ipv4:192.168.1.0/24

CIDR notation works for IPv6, but you must escape the colon characters in IPv6.

You can use quotation marks, which are easier than inserting multiple backslashes. Each of the following styles of notation are valid:

netconn_ipv6:FE80\:0000\:0000\:0000\:E42A\:22A2\:8CD0\:CC47

netconn_ipv6:"fe80:0:0:0:0:0:0:0/16"

netconn_ipv6:"2001:db8::/127"

Wildcards work, but less efficiently than CIDR-notated address ranges.

The following searches are supported:

netconn_ipv4:192.168.1.*

netconn_ipv4:192.*

Multiple-wildcarded addresses like 192.*.*.* are treated equivalently to single wildcard.

The following searches are equivalent:

netconn_ipv4:192.*

netconn_ipv4:192.*.*.*