https://pizza.rs/tags/ip_range/Recent content in Ip_range on INFINI PizzaHugoenhttps://pizza.rs/docs/references/aggregation/bucket/ip-range/Mon, 01 Jan 0001 00:00:00 +0000https://pizza.rs/docs/references/aggregation/bucket/ip-range/<h1 id="ip-range-aggregation"> IP range aggregation <a class="anchor" href="#ip-range-aggregation">#</a> </h1> <p>A multi-bucket aggregation like <a href="https://pizza.rs/docs/references/aggregation/bucket/range/"><code>range</code></a>, but for IP addresses — buckets are CIDR masks or from/to IP bounds. It answers network-shape questions: which subnet does this traffic belong to, and how much of it is in the private ranges versus the internet.</p> <h2 id="how-it-works"> How it works <a class="anchor" href="#how-it-works">#</a> </h2> <p>The field&rsquo;s string values are parsed into 128-bit numbers, with IPv4 mapped into the IPv6 space as <code>::ffff:a.b.c.d</code> — an order-preserving numeric comparison. From/to buckets are half-open on that number (<code>from</code> inclusive, <code>to</code> exclusive), so IPv4 and IPv6 bounds interoperate; <code>10.0.0.0</code> sorts before <code>192.168.0.0</code> sorts before <code>2001:db8::</code>.</p>