# How to search for IP ranges containing a given IP?

**URL:** <https://discuss.elastic.co/t/how-to-search-for-ip-ranges-containing-a-given-ip/28446>\
**Category:** Elasticsearch\
**Created:** [September 1, 2015, 2:43pm UTC](https://discuss.elastic.co/t/how-to-search-for-ip-ranges-containing-a-given-ip/28446 "2015-09-01T14:43:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![WoJ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/woj/32/4518_2.png) [@WoJ](https://discuss.elastic.co/u/WoJ)\
**Post date:** [September 1, 2015, 2:43pm UTC](https://discuss.elastic.co/t/how-to-search-for-ip-ranges-containing-a-given-ip/28446/1 "2015-09-01T14:43:56Z")

</div>

Hello

I have the exact same problem as described in [this old googlegroups thread](http://elasticsearch-users.115913.n3.nabble.com/finding-ip-address-ranges-that-contain-a-given-ip-address-td4025486.html): I have several ranges of IP addresses and would like to retrieve the ones which contain a given IP.

The thread ends with

> If you have multiple ip\_ranges, then you will need to change the mapping from type "object" to type "nested" and use a nested filter instead.

I tried to achieve this by various combination of `nested` and `mappings` but to be honest I am **completely** lost.

What would be the best approach to index, for instance, these three networks (this is taken from my code) :

```
[
            {
                'size': 65536,
                'range': {
                    'from': '10.0.0.0',
                    'to': '10.0.255.255',
                }
            },
            {
                'size': 4096,
                'range': {
                    'from': '10.0.0.0',
                    'to': '10.0.15.255',

                }
            },
            {
                'size': 256,
                'range': {
                    'from': '10.0.0.0',
                    'to': '10.0.0.255',
                }
            },
        ]

```

and then query IPs `10.0.0.1` (should match all three networks) and `10.0.100.1` (should match only one)?

I would appreciate very much any pointers which would help me to understand why the mapping must me nested (these are standalone networks, and my limited understanding is that nesting is to search for entries which are, well, nested (for instance a case where a single document is a host, which has several vulnerabilities - and the search is on the vulnerabilities and not on, the host root properties) - and how to proceed with the search.

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:52pm UTC](https://discuss.elastic.co/t/how-to-search-for-ip-ranges-containing-a-given-ip/28446/2 "2017-07-05T23:52:53Z")

</div>