'\" t
.\" Automatically generated by Pandoc 3.1.11.1
.\"
.TH "ripcalc" "1" "28 December 2025" "ripcalc 0.3.0" "User Manual"
.SH NAME
ripcalc \- a tool for network addresses
.SH SYNOPSIS
\f[B]ripcalc 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-4/\-\-ipv4 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-6/\-\-ipv6 ::1\f[R]
.PP
\f[B]ripcalc \-f/\-\-format \[lq]%a/%c\[rq] 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-m/\-\-mask 28 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-c/\-\-csv path/to/csv [\-i/\-\-field network]
127.0.0.1\f[R]
.PP
\f[B]ripcalc \-l/\-\-list 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-a/\-\-available\f[R]
.PP
\f[B]ripcalc \[en]abuseipdb [KEY]\f[R]
.PP
\f[B]ripcalc \-s/\-\-file [\-] 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-e/\-\-encapsulating [\-s/\-\-file name] [\-\-group CIDR]
[\-\-countseen]\f[R]
.PP
\f[B]ripcalc \-s/\-\-file name [\-\-inside/\-\-outside] 127.0.0.1\f[R]
.PP
\f[B]ripcalc \-b/\-\-base [8, 10, 16 etc]\f[R]
.PP
\f[B]ripcalc \-d/\-\-divide [CIDR] 127.0.0.1/24\f[R]
.PP
\f[B]ripcalc \[en]top [\-\-delay SECONDS] [\-\-interations NUMBER]
[\-\-noclear]\f[R]
.PP
\f[B]ripcalc \[en]makecdb [PATH]\f[R]
.PP
\f[B]ripcalc \[en]makethymecdb [PATH] [\-\-data\-raw\-table PATH]
[\-\-ipv6\-raw\-table PATH] [\-\-data\-used\-autnums PATH]\f[R]
.PP
\f[B]ripcalc [\-\-mmasn PATH] [\-\-mmcountry PATH] [\-\-mmcity
PATH]\f[R]
.PP
\f[B]ripcalc \[en]networks [CIDR] 127.0.0.1/24\f[R]
.PP
\f[B]ripcalc \[en]filter [CIDR]\f[R]
.PP
\f[B]ripcalc \[en]filternum [NUMBER] [CIDR]\f[R]
.PP
\f[B]ripcalc \-q/\-\-quiet\f[R]
.PP
\f[B]ripcalc \-h/\-\-help\f[R]
.SH DESCRIPTION
\f[B]ripcalc\f[R] can read IPv4/IPv6 addresses from command line or
standard input and output different formats or associated networks from
\f[B]CSV\f[R].
.PP
\f[B]ripcalc\f[R] can format network addresses, find matches in
\f[B]CSV\f[R] or process a list.
.PP
\f[B]ripcalc\f[R] can convert input addresses that are in other number
formats such as hex or octal.
.PP
Given a list of IP addresses, print only those that match the network.
When \f[CR]s\f[R] and \f[CR]inside\f[R] are used, only addresses from
\f[CR]\-s\f[R] are printed if they are that are inside of the input IP
network from the command line.
This can be reversed with \f[CR]\-\-outside\f[R],
(e.g.\ \f[CR]ripcalc \-s \- \-\-inside 192.168.0.0/16\f[R]).
.PP
When \f[CR]\-a\f[R] is used, addresses read from \f[CR]\-s\f[R] will not
be shown when listing \f[CR]\-l\f[R] a network, showing only available
addresses.
.PP
When \f[CR]\-\-reverse\f[R] is used the \f[CR]inputs\f[R],
\f[CR]sources\f[R] or both can be treated as back\-to\-front.
.PP
\f[B]ripcalc\f[R] can return a list of subnets when a network is
provided along with the \f[CR]\-\-divide\f[R] argument and a subnet CIDR
mask.
.PP
When \f[CR]\-\-encapsulating\f[R] is used the containing network will be
returned, use with \f[CR]\-\-group\f[R] to limit the range that an
encapsulating network can grow.
Combine with \f[CR]\-\-countseen\f[R] to count the number of times the
addresses are read in.
.PP
The number (\f[B]%D\f[R]) of subnets can be printed when using the
\f[CR]\-\-group\f[R] argument with the \f[B]%N\f[R] formatters.
The argument should be the CIDR mask, see below for example.
.PP
If \f[B]base\f[R] is a negative number, input addresses are treated as
though the input is a signed integer in \f[B]base\f[R].
.PP
If \f[CR]\-\-top\f[R] is given a frequency of IP addresses will be shown
and updated every \f[CR]\-\-delay SECONDS\f[R] (defaults to 1).
This can be used with \f[CR]\-\-cdb\f[R] and \f[CR]\-\-abuseipdb\f[R].
.PP
If \f[CR]\-\-quiet\f[R] is specified then parsing error messages will be
suppressed.
.PP
When \f[CR]\-\-filter\f[R] is specified STDIN is filtered for
addresses/masks given as arguments.
Use \f[CR]\-\-filternum\f[R] to set the space delimited parameter that
contains the input address.
.PP
Using \f[CR]\-\-abuseipdb [key]\f[R] can populate
\f[CR]%{abuseipdb_var}\f[R] values for \f[CR]\-\-format\f[R] strings,
where \f[CR]var\f[R] is the field name in a abuseipdb result structure.
.SH CSV
Network matches can be returned from a \f[B]CSV\f[R].
.IP
.EX
$ cat nets.csv
network,range,owner
rfc1918,192.168.0.0/16,bob
rfc1918,172.16.0.0/12,cliff
rfc1918,10.0.0.0/8,mr nobody
$ ripcalc \-\-csv nets.csv \-i range \-\-format \[aq]%{owner}\[rs]n\[aq] 192.168.0.0
bob
.EE
.PP
Addresses can be read via file or from stdin (\-):
.IP
.EX
$ cat list
127.0.0.1/28
10.0.0.1/28
192.168.1.1/30
172.18.1.1/30
10.0.0.0/30
$ ripcalc \-\-csv nets.csv \-i range \-\-format \[aq]%{range} %{owner}\[rs]n\[aq] \-s list
10.0.0.0/8 mr nobody
192.168.0.0/16 bob
172.16.0.0/12 cliff
10.0.0.0/8 mr nobody
.EE
.SH FORMAT
\f[B]%\f[R] denotes a format control character, followed by one of the
following:
.PP
.TS
tab(@);
l l.
T{
placeholder
T}@T{
effect
T}
_
T{
%a
T}@T{
IP address string
T}
T{
%n
T}@T{
Network address string
T}
T{
%s
T}@T{
Subnet address string
T}
T{
%w
T}@T{
Wildcard address string
T}
T{
%b
T}@T{
Broadcast address string
T}
.TE
.PP
Additional characters prefixing the above placeholder can control the
representation:
.PP
.TS
tab(@);
l l.
T{
placeholder
T}@T{
effect
T}
_
T{
%B
T}@T{
Binary address string
T}
T{
%S
T}@T{
Split binary at network boundary string
T}
T{
%l
T}@T{
Unsigned integer string
T}
T{
%L
T}@T{
Signed integer string
T}
T{
%x
T}@T{
Hex address string
T}
.TE
.PP
Other format characters:
.PP
.TS
tab(@);
l l.
T{
placeholder
T}@T{
effect
T}
_
T{
%c
T}@T{
CIDR mask
T}
T{
%C
T}@T{
In encapsulated context, used address count
T}
T{
%t
T}@T{
Network size
T}
T{
%r
T}@T{
Network reservation information (if available)
T}
T{
%d
T}@T{
Matching device interface by IP
T}
T{
%m
T}@T{
Matching media link interface by network
T}
T{
%p
T}@T{
PTR record
T}
T{
%k
T}@T{
RBL/reverse DNS\-style format
T}
T{
%D
T}@T{
Network size (\-\-networks)
T}
T{
%N
T}@T{
Number of subnets (\-\-networks)
T}
T{
%%
T}@T{
%
T}
T{
\[rs]n
T}@T{
Line break
T}
T{
\[rs]t
T}@T{
Tab character
T}
.TE
.PP
\f[B]%xa\f[R] gives the address in hex, or \f[B]%Sa\f[R] to return the
binary address, split at the network boundary.
.PP
When using \f[B]CSV\f[R] fields can be matched by \f[B]name\f[R] when
network matched:
.IP
.EX
\-\-format \[aq]%{name}\[aq]
.EE
.SH inside/outside
When \f[CR]\-\-inside\f[R] or \f[CR]\-\-outside\f[R] are given addresses
that match \f[CR]\-\-file\f[R] are printed.
If no matches are found \f[CR]ripcalc\f[R] will exit non\-zero.
.SH subnets
For large networks it can be useful to see the number of subnets, to see
the number of /29 subnets within a /24 network, the command would look
like this:
.IP
.EX
ripcalc \-\-networks 29 192.168.230.0/24
            IP is: 192.168.230.0/24
     Broadcast is: 192.168.230.255
       Network is: 192.168.230.0
        Subnet is: 255.255.255.0
      Wildcard is: 0.0.0.255
    Networks (29): 32
.EE
.PP
Or for a IPv6 /48 network that you want to subnet into /64, you can see
there are 65536 subnets:
.IP
.EX
 ripcalc \-\-networks 64 2001:db8:1::/48
                IP is: 2001:db8:1::/48
         Expanded: 2001:0db8:0001:0000:0000:0000:0000:0000
       Network is: 2001:0db8:0001:0000:0000:0000:0000:0000
Last host address: 2001:0db8:0001:ffff:ffff:ffff:ffff:ffff
        Subnet is: ffff:ffff:ffff:0000:0000:0000:0000:0000
    Networks (64): 65536
.EE
.SH encapsulating
Suppose a large flood of requests are from a network pattern, to
preserve service you may want to block the whole network that
encapsulates a list:
.IP
.EX
please ip route add blackhole \[ga]ripcalc \-e 192.168.56.10 192.168.57.1 192.168.44.47\[ga]
.EE
.PP
Networks can be grouped, in a scenario where you have a list of unwanted
traffic, you can turn this into a list of small networks to block,
supposing you don\[cq]t want to block anything that covers more than a
/19:
.IP
.EX
cat bad_traffic | ripcalc \-\-encapsulating \-\-group 19 \-\-format cidr
.EE
.PP
When using \f[CR]group\f[R] the unique IP address count is available in
the \f[CR]%C\f[R] format string.
This can give an overview of which networks have most IP sources:
.IP
.EX
cat bad_traffic | ripcalc \-\-encapsulating \-\-group 19 \-\-format \[aq]%C %a/%c\[rs]n\[aq] | sort \-rn
.EE
.SH ipdb
CDB files can be used for address lookup.
\f[CR]\-\-cdb\f[R] should hold a path to a valid CDB file, in which a
CIDR network address should be used as a key, and NULL\-separated
key=value pairs should be the lookup data.
.PP
CDB files can be created with \f[CR]\-\-makecdb\f[R], which reads comma
separated input, the first value is a CIDR network, followed by
\f[CR],\f[R] joined key=value pairs.
See \f[CR]cdb_maker.pl\f[R] for an example script which can be used to
create such files.
.PP
The option \f[CR]\-\-makethymecdb\f[R] can be used to download an IP
database from \f[CR]https://thyme.apnic.net/\f[R].
Alternatively, if the argument does not start with http, it is treated
as file to read instead of download.
.SH AUTHORS
Ed Neville (ed\-ripcalc\[at]s5h.net).