ripcalc(1)

NAME
ripcalc - a tool for network addresses

SYNOPSIS
ripcalc 127.0.0.1

ripcalc -4/--ipv4 127.0.0.1

ripcalc -6/--ipv6 ::1

ripcalc -f/--format “%a/%c” 127.0.0.1

ripcalc -m/--mask 28 127.0.0.1

ripcalc -c/--csv path/to/csv [-i/--field network] 127.0.0.1

ripcalc -l/--list 127.0.0.1

ripcalc -a/--available

ripcalc –abuseipdb [KEY]

ripcalc -s/--file [-] 127.0.0.1

ripcalc -e/--encapsulating [-s/--file name] [--group CIDR] [--countseen]

ripcalc -s/--file name [--inside/--outside] 127.0.0.1

ripcalc -b/--base [8, 10, 16 etc]

ripcalc -d/--divide [CIDR] 127.0.0.1/24

ripcalc –top [--delay SECONDS] [--interations NUMBER] [--noclear]

ripcalc –makecdb [PATH]

ripcalc –makethymecdb [PATH] [--data-raw-table PATH] [--ipv6-raw-table PATH] [--data-used-autnums PATH]

ripcalc [--mmasn PATH] [--mmcountry PATH] [--mmcity PATH]

ripcalc –networks [CIDR] 127.0.0.1/24

ripcalc –filter [CIDR]

ripcalc –filternum [NUMBER] [CIDR]

ripcalc -q/--quiet

ripcalc -h/--help

DESCRIPTION
ripcalc can read IPv4/IPv6 addresses from command line or standard input and output different formats or associated networks from CSV.

ripcalc can format network addresses, find matches in CSV or process a list.

ripcalc can convert input addresses that are in other number formats such as hex or octal.

Given a list of IP addresses, print only those that match the network. When s and inside are used, only addresses from -s are printed if they are that are inside of the input IP network from the command line. This can be reversed with --outside, (e.g. ripcalc -s - --inside 192.168.0.0/16).

When -a is used, addresses read from -s will not be shown when listing -l a network, showing only available addresses.

When --reverse is used the inputs, sources or both can be treated as back-to-front.

ripcalc can return a list of subnets when a network is provided along with the --divide argument and a subnet CIDR mask.

When --encapsulating is used the containing network will be returned, use with --group to limit the range that an encapsulating network can grow. Combine with --countseen to count the number of times the addresses are read in.

The number (%D) of subnets can be printed when using the --group argument with the %N formatters. The argument should be the CIDR mask, see below for example.

If base is a negative number, input addresses are treated as though the input is a signed integer in base.

If --top is given a frequency of IP addresses will be shown and updated every --delay SECONDS (defaults to 1). This can be used with --cdb and --abuseipdb.

If --quiet is specified then parsing error messages will be suppressed.

When --filter is specified STDIN is filtered for addresses/masks given as arguments. Use --filternum to set the space delimited parameter that contains the input address.

Using --abuseipdb [key] can populate %{abuseipdb_var} values for --format strings, where var is the field name in a abuseipdb result structure.

CSV
Network matches can be returned from a CSV.

        $ cat nets.csv
        network,range,owner
        rfc1918,192.168.0.0/16,bob
        rfc1918,172.16.0.0/12,cliff
        rfc1918,10.0.0.0/8,mr nobody
        $ ripcalc --csv nets.csv -i range --format '%{owner}\n' 192.168.0.0
        bob

Addresses can be read via file or from stdin (-):

        $ cat list
        127.0.0.1/28
        10.0.0.1/28
        192.168.1.1/30
        172.18.1.1/30
        10.0.0.0/30
        $ ripcalc --csv nets.csv -i range --format '%{range} %{owner}\n' -s list
        10.0.0.0/8 mr nobody
        192.168.0.0/16 bob
        172.16.0.0/12 cliff
        10.0.0.0/8 mr nobody

FORMAT
% denotes a format control character, followed by one of the following:

placeholder | effect
%a | IP address string
%n | Network address string
%s | Subnet address string
%w | Wildcard address string
%b | Broadcast address string

Additional characters prefixing the above placeholder can control the representation:

placeholder | effect
%B | Binary address string
%S | Split binary at network boundary string
%l | Unsigned integer string
%L | Signed integer string
%x | Hex address string

Other format characters:

placeholder | effect
%c | CIDR mask
%C | In encapsulated context, used address count
%t | Network size
%r | Network reservation information (if available)
%d | Matching device interface by IP
%m | Matching media link interface by network
%p | PTR record
%k | RBL/reverse DNS-style format
%D | Network size (--networks)
%N | Number of subnets (--networks)
%% | %
\n | Line break
\t | Tab character

%xa gives the address in hex, or %Sa to return the binary address, split at the network boundary.

When using CSV fields can be matched by name when network matched:

        --format '%{name}'

inside/outside
When --inside or --outside are given addresses that match --file are printed. If no matches are found ripcalc will exit non-zero.

subnets
For large networks it can be useful to see the number of subnets, to see the number of /29 subnets within a /24 network, the command would look like this:

        ripcalc --networks 29 192.168.230.0/24
                    IP is: 192.168.230.0/24
             Broadcast is: 192.168.230.255
               Network is: 192.168.230.0
                Subnet is: 255.255.255.0
              Wildcard is: 0.0.0.255
            Networks (29): 32

Or for a IPv6 /48 network that you want to subnet into /64, you can see there are 65536 subnets:

         ripcalc --networks 64 2001:db8:1::/48
                        IP is: 2001:db8:1::/48
                 Expanded: 2001:0db8:0001:0000:0000:0000:0000:0000
               Network is: 2001:0db8:0001:0000:0000:0000:0000:0000
        Last host address: 2001:0db8:0001:ffff:ffff:ffff:ffff:ffff
                Subnet is: ffff:ffff:ffff:0000:0000:0000:0000:0000
            Networks (64): 65536

encapsulating
Suppose a large flood of requests are from a network pattern, to preserve service you may want to block the whole network that encapsulates a list:

        please ip route add blackhole `ripcalc -e 192.168.56.10 192.168.57.1 192.168.44.47`

Networks can be grouped, in a scenario where you have a list of unwanted traffic, you can turn this into a list of small networks to block, supposing you don’t want to block anything that covers more than a /19:

        cat bad_traffic | ripcalc --encapsulating --group 19 --format cidr

When using group the unique IP address count is available in the %C format string. This can give an overview of which networks have most IP sources:

        cat bad_traffic | ripcalc --encapsulating --group 19 --format '%C %a/%c\n' | sort -rn

ipdb
CDB files can be used for address lookup. --cdb should hold a path to a valid CDB file, in which a CIDR network address should be used as a key, and NULL-separated key=value pairs should be the lookup data.

CDB files can be created with --makecdb, which reads comma separated input, the first value is a CIDR network, followed by , joined key=value pairs. See cdb_maker.pl for an example script which can be used to create such files.

The option --makethymecdb can be used to download an IP database from https://thyme.apnic.net/. Alternatively, if the argument does not start with http, it is treated as file to read instead of download.

AUTHORS
Ed Neville (ed-ripcalc@s5h.net).