Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Bitwise Operators in AQL Queries

Enhance the filtering capability and performance of your AQL queries that include IP addresses by using bitwise operators. Specify filters at the IP address octet level to return specific results.

By filtering on octets in an IP address, you can refine the IP address search criteria.

For example, to search for specific device types whose last octet in a source IP address ends in 100, such as x.y.z.100, you can use the following query:

In the example, the <sourceip> is returned as an integer. The integer is used by the bitwise AND operator. The hexadecimal value <ff> in the last octet position for the source IP address specifies a filter in the corresponding IP address octet position of 0x000000<IP address octet hexidecimal value>. In this case, the hexadecimal value <64> is substituted for the decimal value 100 in the IP address.

The result is all source IP addresses that end in 100. The results can be a list for a specific device type for a company, if the last octet of all of the IP addresses is 100.

The following examples outline scenarios to use when you search with bitwise operators.

Bitwise AND (&) Examples

Returns all IP addresses that match

Returns all IP addresses that match

Returns all IP addresses that match

Returns all IP addresses that match

Bitwise NOT (~) Examples

Use the following examples to convert each 1-bit value to a 0-bit value, or each 0-bit value to a 1-bit value, in a given binary pattern.

Returns 123456790

Returns -1

Returns - 2147483648

Bitwise OR Examples

Use the following examples compare two bits. If both bits have a value of "1", then the query returns a 1. If both bits have a value of "0", then the query returns a 0.

Returns -1

Bitwise XOR Examples

The following examples can be used to take 2-bit patterns, or a pair of bits from each position, and convert them to either a 1 or a 0. If the bits are different, the result in that position is 1. If the bits are identical, the result in that position is 0.

Returns 0

Returns 10940, 10940

ShiftLeft Examples

The number of places to shift is given as the second argument to the shift operator.

Returns -2

Returns 128

ShiftRight Examples

The operator >> uses the sign bit, which is the left-most bit, to fill the trailing positions after the shift. If the number is negative, then 1 is used as a filter and if the number is positive, then 0 is used as a filter.

Returns 2

ShiftRightUnsigned Example

Always fills 0 regardless of the sign of the number.

Returns 2147483647

Dividing by the power of 2.