---
title: "Peek: find matching network prefix (peek)"
canonical: "https://docs.devo.com/space/latest/1358823425/Peek%3A%20find%20matching%20network%20prefix%20(peek)"
format: markdown
---
> Macro (toc)

## Description

Returns the first network prefix in an array of prefixes where the prefix matches the given network address.

An organization’s network is divided into subnets.  Each subnet has a network prefix identifying the IPs in the network.  For each prefix, there are security and compliance policies.  A log indicates the IP address of a compromised machine.  Using `peek`, an analyst can identify the prefix for that IP, which is useful for determining which security and compliance policies apply to the security incident.

## How does it work in the search window?

1. Create an array of *net4* or *net6*.
2. Select **Create field** again in the search window toolbar, then select the** Peek **operation. You need to specify two arguments:

| **Argument** | **Data type** |
| --- | --- |
| **Address **<sup><span style="color: #bf2600">mandatory</span></sup> | *ip4* or *ip6* |
| **Pattern** <sup><span style="color: #bf2600">mandatory</span></sup> | *Array of net4* or *Array of net6* |

The data type of the values in the new field is the same as the data type of the elements of the array argument.

![image-20250702-220541.png](media://81cbcfe5-e3f1-4873-b848-e4b57e7a7975)

![image-20250702-220529.png](media://e705a80a-b754-4d4b-b957-89746daec9e3)

The first item in the array matches IP4 addresses starting with 192.  The second item in the array matches the IP4 address 190.107.232.9.

## How does it work in LINQ?

```
from siem.logtrust.web.activity group

select mkarray(
    net6("ffff:ffff:ffff::/45"),
    net6("::ffff:c000:0/104"),
    net6("::ffff:192.168.0.0/128"),
    net6("::/128")
) as net6_array,

mkarray(
    ip6(ip4(192.168.0.1)),
    ip6("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"),
    ip6("0000:0000:0000:0000:0000:0000:0000:0000")
) as ip6_array,

//Find a net6 matching an ip4
peek(ip4(192.168.0.1),net6_array) as match1,

//Find a net6 matching the ip6 that is all zeros.
//Notation allows the zeros to be contracted
peek(ip6("::"),net6_array) as match2,

//Find a net6 matching another ip6
peek(ip6("ffff:ffff:ffff:aaaa::"),net6_array) as match3,

//For an array of ip6, find the net6 matching each ip6
map(ip6_array,'
    peek(_,
        mkarray(
            net6("ffff:ffff:ffff::/45"),
            net6("::ffff:c000:0/104"),
            net6("::ffff:192.168.0.0/128"),
            net6("::/128")
        )
    )
') as match_array
```

![image-20250702-222642.png](media://5ba68efc-69b5-407f-ad22-1b60dc2ea24b)

```
from siem.logtrust.web.activity group

select mkarray(
net4("1.1.1.0/24"),
net4("2.1.1.0/24")
) as net4_array,
peek(ip4(2.1.1.1),net4_array)
```