anonip()

The anonip() function anonymizes an IPv4 address into an anonymized IPv4 address using the Crypto-PAn algorithm. It conceals the actual address while preserving the structural characteristics of the original IP address (prefix preservation).

Syntax

anonip(IP[, KEY])

Parameters

IP
The IPv4 address to anonymize. Accepts a string or IP address type.
KEY
(Optional) The encryption key to use for anonymization. Fixed at 32 bytes; if shorter than 32 bytes, it is padded with spaces, and if longer, only the first 32 bytes are used. If omitted or null, a random key is generated for each query execution.

Description

The anonip() function anonymizes an IPv4 address using the Crypto-PAn (Cryptography-based Prefix-preserving Anonymization) algorithm. This algorithm preserves the property that addresses sharing the same network prefix retain the same prefix after anonymization.

Using the same key always produces the same anonymized result for the same IP address. If the key is null or omitted, a random key is generated at query execution time, making the anonymization non-reproducible.

If the IPv4 address format is invalid, the original value is returned unchanged. Returns null if IP is null.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

  1. Anonymize the source IP address with a specified key.

    table limit=5 WEB_APACHE_SAMPLE | eval anon = anonip(src_ip, "mySecretKey")
| fields src_ip, anon

  2. Anonymize using a random key by omitting the key.

    table limit=5 WEB_APACHE_SAMPLE | eval anon = anonip(src_ip)
| fields src_ip, anon
| # anon: results differ on each execution when the key is omitted

  3. NULL input

    json "{}" | eval anon = anonip(null, "mySecretKey")
| # anon: null

Change history

The anonip() function has been available since before Sonar 4.0.