XIPS(1)                          User Commands                          XIPS(1)

# NAME

**xips** — expand, summarize, sort, and convert IP addresses

# SYNOPSIS

**xips** \[**-4**] \[**-6**] \[**-v**] \[**-s**] \[**--sort**] \[**--cidr**|**--mask**] \[*options*] \[*file* ...]

*your_command* | **xips** \[*options*]

# DESCRIPTION

**xips** reads IP addresses, ranges, subnets, and MAC addresses from standard
input (or from files) and **transforms** them. By default it *expands* every
range or subnet it reads into the full list of individual addresses, one per
line. It can instead summarize many addresses into CIDR blocks, sort, count,
decompose ranges into covering CIDRs, convert between formats, perform set
operations, and more. Both IPv4 and IPv6 are supported.

**xips** is the transformer counterpart to **ips**(1), which is a grep-like
filter that *finds* IP addresses inside arbitrary text. **xips** operates on
the addresses themselves.

To avoid accidentally emitting an enormous list (for example by expanding a
**/8** or a large IPv6 block), **xips** refuses to output more than 1,000,000
addresses unless **--anyway** is given.

# INPUT SYNTAX

The following forms are accepted on input, separated by whitespace or newlines:

**192.168.1.1**
: A single address.

**192.168.1.1-192.168.1.255**
: An inclusive hyphenated range.

**192.168.1.5-15**
: A short hyphenated range (192.168.1.5 through 192.168.1.15).

**192.168.1.0/24**
: A CIDR subnet.

**192.168.1.1/C**
: Class A/B/C shorthand prefix.

**'192.168.1.1 255.255.255.0'**
: An address with a dotted subnet mask.

**2001:db8::/64**
: IPv6 address, range, or CIDR.

**00:11:22:33:44:55**
: A MAC address (with **--mac-to-ipv6**).

Encoded 32-bit IPv4 values are also accepted:

```
0xAABBCCDD      \xAA\xBB\xCC\xDD      %AA%BB%CC%DD      0b<32 bits>      AABBCCDD
```

# OPTIONS

## Address family

**-4**
: Process IPv4 addresses only.

**-6**
: Process IPv6 addresses only.

## Core modes

**-s**
: Summarize rather than expand — collapse addresses into CIDR blocks
  (collapses at >50% utilization by default).

**--sort**
: Expand, deduplicate, and sort numerically.

**--shuffle**
: Output IPs in random order (deduplicates like **--sort**).

**--count**
: Count unique IPs and print the total instead of listing them.

## Summarization tuning

**-m** *X*, **--max-depth** *X*
: Summarize to a maximum depth of /*X*.

**--max-depth-ipv4** *X*
: Maximum CIDR depth for IPv4 only.

**--max-depth-ipv6** *X*
: Maximum CIDR depth for IPv6 only.

**--threshold** *X*
: Collapse threshold percentage, 1–100 (default: 50).

## Output format

**--mask**
: Output subnet-mask notation instead of CIDR.

**--asa**
: Output ASA **network-object** notation.

**--port** *N*
: Append a port suffix: *1.2.3.4:N* or *[::1]:N*.

**--cidr-list**
: Decompose a range into the exact set of covering CIDR blocks.

**--hex-be**, **--hex**
: Output IPs as big-endian hex.

**--hex-le**
: Output IPs as little-endian hex.

**--to-mapped**
: Output IPv4 addresses as *::ffff:x.x.x.x* (IPv4-mapped IPv6).

**--arpa**
: Output IPs as reverse-DNS zone names (*in-addr.arpa* / *ip6.arpa*).

**--subnet-info**
: Print a TSV row per subnet: Network, Broadcast, Mask, Wildcard, Prefix,
  First Host, Last Host, Total IPs, Usable Hosts.

## Filtering

**--private**
: Only output private / RFC1918 addresses.

**--public**
: Only output non-private addresses.

**--hosts**
: Exclude network and broadcast (first/last) addresses from ranges.

**--exclude** *R*
: Exclude range *R* from output (may be repeated).

## MAC conversion

**--mac-to-ipv6**
: Convert MAC addresses to EUI-64 link-local IPv6 (*fe80::*).

**--ipv6-to-mac**
: Extract the MAC from EUI-64 MAC-derived IPv6 addresses.

## Set operations and queries

**--check** *IP*
: Check whether an IP or subnet is within / overlaps the input ranges
  (may be repeated).

**--check-file** *FILE*
: As **--check**, reading the IPs/subnets to test from a file.

**--diff** *FILE*
: Output CIDRs from the input ranges *not* covered by ranges in *FILE*.

## Input and miscellaneous

**-f** *file*, **--file** *file*
: Read input from a file instead of stdin (may be repeated).

**--anyway**
: Bypass the >1,000,000-address guard rail.

**-v**
: Display version information.

# EXAMPLES

Expand a subnet:

```
$ echo "192.168.1.0/30" | xips
192.168.1.0
192.168.1.1
192.168.1.2
192.168.1.3
```

Summarize addresses into CIDR:

```
$ printf "10.0.0.1\n10.0.0.2\n10.0.0.3\n" | xips -s
10.0.0.0/30
```

Sort and deduplicate:

```
$ printf "10.0.0.3\n10.0.0.1\n10.0.0.2\n" | xips --sort
10.0.0.1
10.0.0.2
10.0.0.3
```

Count addresses in a range:

```
$ echo "10.0.0.0/24" | xips --count
256
```

Decompose a range into covering CIDR blocks:

```
$ echo "192.168.1.1-192.168.1.10" | xips --cidr-list
192.168.1.1/32
192.168.1.2/31
192.168.1.4/30
192.168.1.8/31
192.168.1.10/32
```

Per-subnet information (TSV):

```
$ echo "192.168.1.0/24" | xips --subnet-info
Network     Broadcast      Mask           Wildcard    /Prefix  First Host   Last Host      Total IPs  Usable Hosts
192.168.1.0 192.168.1.255  255.255.255.0  0.0.0.255   /24      192.168.1.1  192.168.1.254  256        254
```

Subnet-mask notation:

```
$ echo "10.0.0.0/30" | xips -s --mask
10.0.0.0 255.255.255.252
```

Reverse-DNS name:

```
$ echo "8.8.8.8" | xips --arpa
8.8.8.8.in-addr.arpa
```

Append a port to every address:

```
$ echo "10.0.0.0/30" | xips --port 80
10.0.0.0:80
10.0.0.1:80
10.0.0.2:80
10.0.0.3:80
```

# SEE ALSO

**ips**(1) — grep-like tool to find IP addresses inside text.

<http://www.elifulkerson.com>

# AUTHOR

Written by Eli Fulkerson.

XIPS(1)                            xips v0.6                            XIPS(1)