reverseip()

Returns the octets of the given IP address in reverse order. For example, if you provide 127.0.0.1, it returns 1.0.0.127. This returns null if any invalid IPv4 address string is provided.

Syntax

reverseip(EXPR)
Required Parameter
EXPR
IP address type value or an expression that returns a string in an IPv4 address format

Usage

Reverse the octet order of an IP address and concatenate it with .in-addr.arpa for reverse domain lookup.

json "{}" 
| eval ip = "172.217.14.238" 
| eval domain = concat(reverseip(ip), ".in-addr.arpa") 
| nslookup ns="1.1.1.1" type=PTR domain output status, answers

The output fields are as follows:

  • ip: 172.217.14.238
  • domain: 238.14.217.172.in-addr.arpa
  • status: NO_ERROR
  • answers: ["PTR sea30s02-in-f14.1e100.net"]

See Also