Extract IP prefix

Reduces an IP address to the network it belongs to and writes that value into another field.

Configuration	Content
Source: IP address	text field holding the address
Destination: Prefix	text field that receives the prefix
Setting: IPv4	prefix length, default 32, maximum 32
Setting: IPv6	prefix length, default 64, maximum 128

The reason it exists is IPv6. An IPv4 address identifies one access point, but an IPv6 subscriber gets a whole range to spend as it likes: a single connection can walk billions of addresses without ever repeating one. Counting individual IPv6 addresses, therefore, counts nothing: every attempt looks like a first-time visitor. Reducing the address to its prefix makes “attempts from this address” mean the same thing in both families.

The two lengths are configured separately because a single number cannot serve both, and because the right aggregation depends on the traffic, not on the protocol: /64 is the standard residential range in IPv6, but a provider handing out /56 requires a wider prefix, and an IPv4 estate behind NAT may justify grouping at /24.

The written value comes out in CIDR notation, with the /n suffix only when the address was actually reduced, so that a /32 and a /24 of the same address can never be read as the same value. A malformed address writes nothing.