R

30

141

Given an ip address (say 192.168.0.1), how do I check if it's in a network (say 192.168.0.0/24) in Python?

Are there general tools in Python for ip address manipulation? Stuff like host lookups, ip adddress to int, network address with netmask to int and so on? Hopefully in the standard Python library for 2.5.

Resnick answered 4/5, 2009 at 8:59 Comment(0)

K

28

This article shows you can do it with socket and struct modules without too much extra effort. I added a little to the article as follows:

import socket,struct

def makeMask(n):
    "return a mask of n bits as a long integer"
    return (2L<<n-1) - 1

def dottedQuadToNum(ip):
    "convert decimal dotted quad string to long integer"
    return struct.unpack('L',socket.inet_aton(ip))[0]

def networkMask(ip,bits):
    "Convert a network address to a long integer" 
    return dottedQuadToNum(ip) & makeMask(bits)

def addressInNetwork(ip,net):
   "Is an address in a network"
   return ip & net == net

address = dottedQuadToNum("192.168.1.1")
networka = networkMask("10.0.0.0",24)
networkb = networkMask("192.168.0.0",24)
print (address,networka,networkb)
print addressInNetwork(address,networka)
print addressInNetwork(address,networkb)

This outputs:

False
True

If you just want a single function that takes strings it would look like this:

import socket,struct

def addressInNetwork(ip,net):
   "Is an address in a network"
   ipaddr = struct.unpack('L',socket.inet_aton(ip))[0]
   netaddr,bits = net.split('/')
   netmask = struct.unpack('L',socket.inet_aton(netaddr))[0] & ((2L<<int(bits)-1) - 1)
   return ipaddr & netmask == netmask

Kinshasa answered 4/5, 2009 at 9:21 Comment(10)

I guess there might be big and little endian problems here, but since both network and ip address resolution happens on the same computer, both number should have the same error and at least be in the same endian order. – Resnick 4/5, 2009 at 9:38

Good point, although I don't think there are any "problems" as such. The key thing is that stuct.unpack and socket.inet_aton both default to the system endianness so the long you end up with will always be OK and match the masks created by the makeMask function. Once you have longs it doesn't matter which order the bytes are checked when you use the bitwise operators. – Kinshasa 4/5, 2009 at 10:5

AFAIK inet_aton defaults to network byte order, which is big endian. In fact your code depends on inet_aton having endianness opposite to the system one, so that the first bytes of ip address (e.g. 10 in "10.0.0.0") align with the least significant bytes of the mask (e.g 0xff in 0x000000ff). – Atul 4/5, 2009 at 15:13

Additionally, struct.unpack('L',socket.inet_aton(ip))[0] will fail on architectures where 'L' unpacks to something different than 4 bytes, regardless of endianness. – Atul 4/5, 2009 at 15:33

Continuing on Rafal's comment, to get this to work on a 64-bit Python interpreter, replace the line in question with: return struct.unpack('<L',socket.inet_aton(ip))[0] – Collenecollet 22/1, 2012 at 9:24

I think your solution has a serious bug: addressInNetwork('172.7.1.1', '172.3.0.0/16') -> True (I converted 'L' to '<L' in my 64bit os) – Carmacarmack 10/2, 2012 at 5:1

CAUTION: This solution has a serious bug: addressInNetwork('172.7.1.1', '172.3.0.0/16') -> True – Carmacarmack 21/8, 2012 at 5:27

This answer has a bug. See answer: #819855 – Interment 22/4, 2014 at 21:12

I think that people are adding two solutions: If the IP can be pinged and is currently assigned to a client, or if the IP is in the network's IP range – Lay 28/5, 2014 at 21:31

This answer has two fatal bugs: 1. others has pointed out, its logic is error at statement ip & net == net, which will return true when ip='11.0.1.1' and net='10.0.0.0/8'; 2. it works only on little-endian machine even fix the first bug. It's incompatible on big-endian machine. The resolution is to always use function ntohl() (in python, it is socket.ntohl()) to convert the integer returned by inet_aton(). And after use ntohl(), we need to compare the n bits at the beginning rather than the n bits at the ending. – Lineberry 18/4, 2018 at 19:34

O

203

Using ipaddress (in the stdlib since 3.3, at PyPi for 2.6/2.7):

>>> import ipaddress
>>> ipaddress.ip_address('192.168.0.1') in ipaddress.ip_network('192.168.0.0/24')
True

If you want to evaluate a lot of IP addresses this way, you'll probably want to calculate the netmask upfront, like

n = ipaddress.ip_network('192.0.0.0/16')
netw = int(n.network_address)
mask = int(n.netmask)

Then, for each address, calculate the binary representation with one of

a = int(ipaddress.ip_address('192.0.43.10'))
a = struct.unpack('!I', socket.inet_pton(socket.AF_INET, '192.0.43.10'))[0]
a = struct.unpack('!I', socket.inet_aton('192.0.43.10'))[0]  # IPv4 only

Finally, you can simply check:

in_network = (a & mask) == netw

Ochre answered 17/6, 2009 at 0:15 Comment(4)

Beware, python-ipaddr behaved quite slow for us, so it may be unsuitable for some cases where a lot of comparsions are required frequently. YMMV, so benchmark yourself. – Lundgren 6/6, 2012 at 13:7

In some versions, you may need to supply a unicode string instead of a Python str type, like ipaddress.ip_address(u'192.168.0.1') in ipaddress.ip_network(u'192.168.0.0/24') . – Where 13/10, 2017 at 14:56

I was concerned that this method was iterating over the list of addresses in the network, but the ipaddress module overrides __contains__ method to do it in an efficient way by comparing the integer representations of the network and broadcast addresses, so rest assured if that was your worry. – Yepez 1/11, 2018 at 21:28

To check if a network contains a network, you can use overlaps from ipaddress, e.g. ipaddress.ip_network('192.168.0.16/28').overlaps(ipaddress.ip_network('192.168.0.0/24')) – Tolyl 10/4, 2022 at 22:53

D

175

I like to use netaddr for that:

from netaddr import CIDR, IP

if IP("192.168.0.1") in CIDR("192.168.0.0/24"):
    print "Yay!"

As arno_v pointed out in the comments, new version of netaddr does it like this:

from netaddr import IPNetwork, IPAddress
if IPAddress("192.168.0.1") in IPNetwork("192.168.0.0/24"):
    print "Yay!"

Dogs answered 4/5, 2009 at 13:35 Comment(3)

>>> netaddr.all_matching_cidrs("192.168.0.1", ["192.168.0.0/24","212.11.64.0/19"] ) [IPNetwork('192.168.0.0/24')] – Disconnected 6/9, 2011 at 17:25

Or in the new version: from netaddr import IPNetwork, IPAddress IPAddress("192.168.0.1") in IPNetwork("192.168.0.0/24") – Woodson 13/2, 2013 at 12:37

Note that this approach, although nice API, requires installation of third-party module. Whereas the other answer, which discusses builtin ipaddress module, does not. – Luge 23/11, 2020 at 22:5

G

64

For python3

import ipaddress
ipaddress.IPv4Address('192.168.1.1') in ipaddress.IPv4Network('192.168.0.0/24')
ipaddress.IPv4Address('192.168.1.1') in ipaddress.IPv4Network('192.168.0.0/16')

Output :

False
True

Gschu answered 23/7, 2018 at 6:4 Comment(1)

The standard lib uses clever bitwise checking so this is the most optimal solution here. github.com/python/cpython/blob/3.8/Lib/ipaddress.py#L690 – Milestone 7/4, 2020 at 13:12

M

31

Using Python >= 3.7 ipaddress:

import ipaddress

address = ipaddress.ip_address("192.168.0.1")
network = ipaddress.ip_network("192.168.0.0/16")

print(network.supernet_of(ipaddress.ip_network(f"{address}/{address.max_prefixlen}")))

Explanation

You can think of an IP Address as a Network with the largest possible netmask (/32 for IPv4, /128 for IPv6)

Checking whether 192.168.0.1 is in 192.168.0.0/16 is essentially the same as checking whether 192.168.0.1/32 is a subnet of 192.168.0.0/16

Milestone answered 26/12, 2019 at 7:16 Comment(5)

...not sure why this answer is not at the top (yet). – Overly 23/3, 2020 at 16:52

Thanks for this helpful answer of the constraint Python >= 3.7? I've seen in the doc that it has been introduced in version 3.3. – Extenuate 1/6, 2021 at 20:25

even easier, all built in: if IPv4Address('192.0.2.6') in IPv4Network('192.0.2.0/28') – Rajah 12/5, 2022 at 12:7

@Rajah Yeah I've commented that under petertc's answer https://mcmap.net/q/159401/-how-can-i-check-if-an-ip-is-in-a-network-in-python – Milestone 16/5, 2022 at 14:48

@Rajah - Although right, checking ip_address in ip_network will be more time consuming – Shoshonean 13/12, 2023 at 9:22

K

28

This article shows you can do it with socket and struct modules without too much extra effort. I added a little to the article as follows:

import socket,struct

def makeMask(n):
    "return a mask of n bits as a long integer"
    return (2L<<n-1) - 1

def dottedQuadToNum(ip):
    "convert decimal dotted quad string to long integer"
    return struct.unpack('L',socket.inet_aton(ip))[0]

def networkMask(ip,bits):
    "Convert a network address to a long integer" 
    return dottedQuadToNum(ip) & makeMask(bits)

def addressInNetwork(ip,net):
   "Is an address in a network"
   return ip & net == net

address = dottedQuadToNum("192.168.1.1")
networka = networkMask("10.0.0.0",24)
networkb = networkMask("192.168.0.0",24)
print (address,networka,networkb)
print addressInNetwork(address,networka)
print addressInNetwork(address,networkb)

This outputs:

False
True

If you just want a single function that takes strings it would look like this:

import socket,struct

def addressInNetwork(ip,net):
   "Is an address in a network"
   ipaddr = struct.unpack('L',socket.inet_aton(ip))[0]
   netaddr,bits = net.split('/')
   netmask = struct.unpack('L',socket.inet_aton(netaddr))[0] & ((2L<<int(bits)-1) - 1)
   return ipaddr & netmask == netmask