## CIDR_MATCH

The `CIDR_MATCH` function checks if a given IP address is contained within one or more specified CIDR blocks.

## Syntax

`CIDR_MATCH(ip, blockX)`

### Parameters

#### `ip`

The IP address to test. Must be of type `ip` (supports both IPv4 and IPv6).

#### `blockX`

One or more CIDR blocks to test the IP address against.

## Examples

Filtering IP addresses

```esql
FROM hosts
| WHERE CIDR_MATCH(ip1, "127.0.0.2/32")
| KEEP host, ip1
```

Filtering IP addresses within specific CIDR blocks


```esql
FROM hosts
| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32")
| KEEP host, ip1
```

This example filters rows where the `ip1` column contains an IP address that falls within the specified CIDR blocks (`127.0.0.2/32` or `127.0.0.3/32`). It then keeps the `card`, `host`, `ip0`, and `ip1` columns in the output.
