> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidr6.md).

# incidr6

Use the `incidr6()` function to determine if an IPv6 address falls within one or more specified Classless Inter-Domain Routing (CIDR) blocks.

## Syntax

```sql
incidr6 (<ipv6_address_field>, "<cidr6_range1>[, <cidr6_range2>...]")
```

## Parameters

| Name                 | Type       | Required | Description                                                                                                                                                             |
| -------------------- | ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ipv6_address_field` | string, ip | Yes      | The IPv6 address field (or explicit string literal) to evaluate.                                                                                                        |
| `cidr6_range`        | string     | Yes      | One or more IPv6 CIDR ranges, provided as a comma-separated string enclosed in double quotes (for example, `"2001:db8::/32"` or `"2001:db8::/32, 2001:db8:cafe::/48"`). |

## Returns

The `incidr6()` function returns a boolean value (`true` or `false`). The function returns `true` if the address falls within any of the defined ranges, and `false` otherwise.

## Usage notes

* This function is designed specifically for IPv6 addresses. Use `incidr()` for IPv4 addresses.
* The first parameter must contain an IPv6 address contained in an IPv6 field. For production purposes, this IPv6 address will normally be carried in a field that you retrieve from a dataset. For manual usage, assign the IPv6 address to a field, and then use that field with this function.
* When multiple CIDR ranges are provided in the second parameter (separated by commas), the function applies a logical **OR** operation. If the IPv6 address matches any of the listed ranges, the function returns `true`.
* This function is commonly used within the `filter` stage to narrow down results based on network segments or specific IP ranges.

## Examples

### Example 1: Check against a single IPv6 CIDR

**Goal**: Filter for records where the `ipv6_address` falls within a specific `/32` global unicast CIDR block.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv6_address incidr6("2001:0db8::/32") 
| fields event_id, ipv6_address 
| limit 5 
```

**Explanation**: The query evaluates the `ipv6_address` field for each record. The query returns only those records where the address (for example, `2001:0db8::1`) falls within the `2001:0db8::/32` range.

**Output**:

| EVENT\_ID | IPV6\_ADDRESS        |
| --------- | -------------------- |
| 103       | 2001:0db8::1         |
| 107       | 2001:0db8:cafe::1    |
| 109       | 2001:0db8:1234::abcd |

### Example 2: Check against multiple IPv6 CIDRs

**Goal**: Filter for records where the `ipv6_address` falls within *either* of the specified IPv6 CIDR ranges.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv6_address incidr6("2001:0db8:cafe::/48, 2001:0db8:1234::/48") 
| fields event_id, ipv6_address 
| limit 5 
```

**Explanation**: The query uses a comma-separated list of CIDRs. The query returns records where the `ipv6_address` matches either the first range (`2001:0db8:cafe::/48`) OR the second range (`2001:0db8:1234::/48`). Event ID 107 matches the first, and Event ID 109 matches the second.

**Output**:

| EVENT\_ID | IPV6\_ADDRESS        |
| --------- | -------------------- |
| 107       | 2001:0db8:cafe::1    |
| 109       | 2001:0db8:1234::abcd |

## Related articles

* **Stages**: [`filter`](/xql-command-reference-guide/readme/stages/filter.md)
* **Functions**: [`incidr`](/xql-command-reference-guide/readme/functions/incidr.md), [`incidrlist`](/xql-command-reference-guide/readme/functions/incidrlist.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidr6.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.