Searching CIDRs for IPv4/6 Addresses

Cloud service providers like Amazon Web Service (AWS), Microsoft Azure, Google Cloud Platform (GCP), etc. provide their CIDR network IPv4/6 ranges for consumption. During analysis, we could use WHOIS information to determine ownership of a specific IP address. However, using this OSINT, we can glean some additional information on a particular IP address like possible services operating in particular regions.

AWS IP Address Ranges Example:

https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

Two challenges exist with this data set that needs addressing. First, it is only a point in time snapshot of currently configured CIDR ranges that had seven updates in a 24-hour window. I like DynamoDB, but a database of your choosing can resolve this issue. Second, there are 3,284 CIDR ranges listed presently that need to be normalized for searching.

Task:

Determine if the IP address 18.181.182.183 is part of the CIDR network range 18.180.0.0/15 with Python?

Step 1 - Import library and declare variables

import ipaddress
  
ipaddr = '18.181.182.183' 
cidr = '18.180.0.0/15'

Step 2 - Split the network address from the CIDR for a version validation

hostnetwork = cidr.split('/')
iptype = ipaddress.ip_address(hostnetwork[0])

Step 3 - Check the IP Address version to find Network and Broadcast addresses of the CIDR range for integer conversion

if iptype.version == 4:
	netrange = ipaddress.IPv4Network(cidr)
	firstip, lastip = netrange[0], netrange[-1]
	intfirstip = int(ipaddress.IPv4Address(firstip))
	intlastip = int(ipaddress.IPv4Address(lastip))

Step 4 - Test if IP Address is version 4 or 6 for integer conversion again

iptype = ipaddress.ip_address(ipaddr)

if iptype.version == 4:
	intipaddr = int(ipaddress.IPv4Address(ipaddr))

Step 5 - Determine if IP Address integer is between first and last IP of the CIDR range

if intipaddr >= intfirstip and intipaddr <= intlastip:
	print('YES!')
else:
	print('NO!')

Always more than one way to solve a problem, but this is what worked for me. The source code below includes an example that provides for IPv6 too. If people are interested in how I did the data modeling in DynamoDB, I would be happy to share that as well!

Happy Coding,

John Lukach

REFERENCE

https://docs.python.org/3/library/ipaddress.html

SOURCE CODE

import ipaddress
  
ipaddr = '18.181.182.183' 
cidr = '18.180.0.0/15'

### CIDR ###

hostnetwork = cidr.split('/')
iptype = ipaddress.ip_address(hostnetwork[0])

### IPV4 ###

if iptype.version == 4:
	netrange = ipaddress.IPv4Network(cidr)
	firstip, lastip = netrange[0], netrange[-1]
	intfirstip = int(ipaddress.IPv4Address(firstip))
	intlastip = int(ipaddress.IPv4Address(lastip))

### IPV6 ###

elif iptype.version == 6:
	netrange = ipaddress.IPv6Network(cidr)
	firstip, lastip = netrange[0], netrange[-1]
	intfirstip = int(ipaddress.IPv6Address(firstip))
	intlastip = int(ipaddress.IPv6Address(lastip))
	
### IP ADDRESS ###
	
iptype = ipaddress.ip_address(ipaddr)

if iptype.version == 4:
	intipaddr = int(ipaddress.IPv4Address(ipaddr))

elif iptype.version == 6:
	intipaddr = int(ipaddress.IPv6Address(ipaddr))
	
### ANSWER ###

if intipaddr >= intfirstip and intipaddr <= intlastip:
	print('YES!')
else:
	print('NO!')