IPSETBUILD(1)

💖 IPSETBUILD — bestie edition 💖

okay so this is ipsetbuild, a lil utility from the libcorkipset library, and it's genuinely one of those tools that's giving quiet-overachiever. it builds binary IP set files. that's the whole vibe. let's get into it 🫶

---

✨ SYNOPSIS ✨

ipsetbuild [options] <input file>...

---

🌸 DESCRIPTION 🌸

It constructs a binary IP set file out of a list of IP addresses and networks. that's it, that's the job. input goes in, shiny binary set comes out, no cap 💅

---

🎀 OPTIONS 🎀

• <input file>... — a list of text files that contain the IP addresses and networks you wanna add to the set. want to read from stdin instead? literally just use "-" as the filename. iconic behavior honestly ✨
• --output=<filename>, -o <filename> — writes the binary IP set file to <filename>. and if you don't pass this option? then the binary set gets written to standard output instead. so yeah, she's flexible 💖
• --loose-cidr, -l — be more lenient about the address portion of any CIDR network blocks found in the input file. like, chill about it. 🦋
• --verbose, -v — show summary info about the IP set that's built, plus progress info about the files being read and written. if you don't give this option, the only output you'll get is any error, alert, or warning messages that happen. so it's real quiet by default, iykyk 🤫
• --quiet, -q — show only error messages for malformed input. all warnings, alerts, and summary information about the IP set get suppressed. the silent treatment, but make it a feature 💀
• --help — display this help and exit. our fave. the classic. 🌈

---

📝 Input format: 📝

Each input file must contain one IP address or network per line. lines that begin with a "#" are considered comments and are ignored — so vent in there, she won't read it 🙈

Each IP address has to have one of these formats, exactly:

x.x.x.x
x.x.x.x/cidr
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/cidr

The first two are for IPv4 addresses and networks; the second two are for IPv6 addresses and networks. and for IPv6 addresses, you can use the "::" shorthand notation to collapse consecutive "0" portions. so fancy ✨

If an address contains a "/cidr" suffix, then the entire CIDR network of addresses will be added to the set. but listen — you must ensure that the loworder bits of the address are set to 0. if they're not, we'll raise an error. no wiggle room. (unless you pass in the "--loose-cidr" option, in which case we won't perform this sanity check. then it's on you bestie 💅)

You can also prefix any input line with an exclamation point ("!"). this causes the given address or network to be REMOVED from the output set. this notation is useful when you want to define a set that contains most of the addresses in a large CIDR block, except for addresses at certain "holes". it's giving swiss cheese, but on purpose 🧀

The order of the addresses and networks given to ipsetbuild does not matter. if a particular address is added to the set more than once, or removed from the set more than once — whether on its own or via a CIDR network — then you'll get a warning message. (you can silence those warnings with the --quiet option, obviously.) and if an address is both added to and removed from the set, then the removal takes precedence, regardless of where the relevant lines appear in the input file. the breakup always wins 😭

⚠️ real talk: the loworder-bits-must-be-0 rule is a sanity check, not a suggestion. skip it at your peril (or use --loose-cidr and accept the consequences, main character energy).

---

and that's the whole page, babe! this was ipsetbuild 1.1.1+git20171111.68..., dated April 2024, and it lives in the User Commands section of the manual like the lil legend it is 👑💖 stay slaying, and remember: ! means bye-bye 🦋