Contribute in GitHub:

ipv4_compare()

Compares two IPv4 strings. The two IPv4 strings are parsed and compared while accounting for the combined IP-prefix mask calculated from argument prefixes, and the optional PrefixMask argument.

ipv4_compare("127.0.0.1", "127.0.0.1") == 0
ipv4_compare('192.168.1.1', '192.168.1.255') < 0
ipv4_compare('192.168.1.1/24', '192.168.1.255/24') == 0
ipv4_compare('192.168.1.1', '192.168.1.255', 24) == 0

Syntax

ipv4_compare(Expr1, Expr2[ ,PrefixMask])

Arguments

Name	Type	Required	Description
Expr1	String	✓	A string expression representing an IPv4 address. IPv4 strings can be masked using IP-prefix notation.
Expr2	String	✓	A string expression representing an IPv4 address. IPv4 strings can be masked using IP-prefix notation.
PrefixMask	Number or String		An integer from 0 to 32 representing the number of most-significant bits that are taken into account.

IP-prefix notation

IP addresses can be defined with IP-prefix notation using a slash (/) character. The IP address to the LEFT of the slash (/) is the base IP address. The number (1 to 32) to the RIGHT of the slash (/) is the number of contiguous 1 bit in the netmask.

For example, 192.168.2.0/24 will have an associated net/subnetmask containing 24 contiguous bits or 255.255.255.0 in dotted decimal format.

Returns

0: If the first IPv4 string argument is equal to the second IPv4 string argument
1: If the first IPv4 string argument is greater than the second IPv4 string argument
-1: If the first IPv4 string argument is less than the second IPv4 string argument
null: If conversion for one of the two IPv4 strings wasn't successful.

Example

Compare IPs using the IP-prefix notation specified inside the IPv4 strings


events_all
| project  ip1_string=src_ip , ip2_string= dst_ip
| extend result = ipv4_compare(ip1_string, ip2_string)
| project ip1_string, ip2_string, result

Results

Showing a sample of the returned results.

ip1_string	ip2_string	result
192.168.1.0	192.168.1.0	0
192.168.56.10	192.168.56.3	1
172.16.0.1	192.168.200.25	-1