--- title: IP Functions are Generally Available, bringing... description: Databricks has made IP Functions Generally Available on Databricks Runtime 18.3 and above, adding native SQL support for IPv4/IPv6 parsing, CIDR containment,... canonical: https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: IP Functions are Generally Available, bringing high-performance network analytics to the Lakehouse | daily.dev og:description: Databricks has made IP Functions Generally Available on Databricks Runtime 18.3 and above, adding native SQL support for IPv4/IPv6 parsing, CIDR containment,... og:url: https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j og:image: https://api.daily.dev/og/posts/1eNN2Q99j.png og:image:alt: IP Functions are Generally Available, bringing high-performance network analytics to the Lakehouse og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # IP Functions are Generally Available, bringing high-performance network analytics to the Lakehouse **[databricks](https://daily.dev/sources/databricks)** · 7 min read · 0 upvotes · 0 comments ## Summary Databricks has made IP Functions Generally Available on Databricks Runtime 18.3 and above, adding native SQL support for IPv4/IPv6 parsing, CIDR containment, and canonicalization directly in the lakehouse engine. This eliminates the need for UDFs, regex, or separate specialized systems to handle IP analytics for threat detection, fraud investigation, and network observability. Functions include ip_cidr_contains, ip_host, ip_cidr, ip_network, ip_version, ip_as_binary/string, and try_ variants that return NULL on malformed input instead of erroring. Benchmarks claim Databricks' ip_cidr_contains is 2x to 6.4x cheaper than competing warehouses across scales up to 10B IP addresses and 10M CIDR blocks, with query speed flattening beyond that. Customers Rearc and Stanby are quoted describing performance and maintainability gains from replacing ad-hoc IP parsing pipelines with native SQL functions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What SQL function checks if an IP address falls inside a CIDR block in Databricks? ip_cidr_contains(cidr, needle) tests whether an IP address falls within a given CIDR block, using an optimized range join built into the Databricks engine rather than string parsing or manual bitwise logic. It supports IPv4 and IPv6 uniformly and works with both STRING and BINARY representations, enabling threat-intel and geo-IP enrichment directly in SQL. _daily.dev surfaces updates like this for engineers building threat-detection pipelines on SQL engines._ ### Which Databricks Runtime version includes native IP functions like ip_host and ip_cidr_contains? Native IP functions became Generally Available on Databricks Runtime 18.3 and above. The release includes functions such as ip_host, ip_cidr, ip_network, ip_prefix_length, ip_version, ip_as_binary, ip_as_string, and try_ safe variants that return NULL instead of erroring on malformed input, all accelerated by the query optimizer and Photon. _Track lakehouse runtime upgrades like this on daily.dev before planning a migration._ ### How much faster is Databricks ip_cidr_contains compared to traditional data warehouses for IP range joins? Databricks remains 2x to as much as 6.4x cheaper than competing warehouses for IP range joins using ip_cidr_contains, with the performance advantage holding even as workloads scale to 10 billion IP addresses and 10 million CIDR blocks, at which point query speed across the industry begins to flatline. _Developers weighing warehouse options for network analytics can follow benchmarks like this on daily.dev._ ## Similar posts on daily.dev - [SQL on the Databricks Lakehouse in 2025](https://daily.dev/posts/sql-on-the-databricks-lakehouse-in-2025-h08uqz40h) · databricks · 0 upvotes · 0 comments - [Geospatial Unbounded: Spatial SQL GA with AI/BI Maps, Delta Sharing, and Iceberg v3](https://daily.dev/posts/geospatial-unbounded-spatial-sql-ga-with-ai-bi-maps-delta-sharing-and-iceberg-v3-ta19gry1t) · databricks · 0 upvotes · 0 comments - [Introducing Cloudflare Basin: an open, serverless data platform, now generally available](https://daily.dev/posts/introducing-cloudflare-basin-an-open-serverless-data-platform-now-generally-available-q5jsjfzje) · Cloudflare · 1 upvotes · 0 comments - [Executable UDFs are now generally available on ClickHouse Cloud](https://daily.dev/posts/executable-udfs-are-now-generally-available-on-clickhouse-cloud-ikg7iq8la) · ClickHouse · 2 upvotes · 0 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#big-data](https://daily.dev/tags/big-data), [#databricks](https://daily.dev/tags/databricks) [View this post on daily.dev](https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"IP Functions are Generally Available, bringing high-performance network analytics to the Lakehouse","url":"https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j"},"datePublished":"2026-09-30T23:46:51.755Z","dateModified":"2026-09-30T23:47:19.433Z","description":"Databricks has made IP Functions Generally Available on Databricks Runtime 18.3 and above, adding native SQL support for IPv4/IPv6 parsing, CIDR containment,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d139f3c240a01fe1103216ee594c85f4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d139f3c240a01fe1103216ee594c85f4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"databricks","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"databricks","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/fa7aa720f2db4d1eba826814730482c8","url":"https://daily.dev/sources/databricks"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sql,big-data,databricks","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"databricks","item":"https://daily.dev/sources/databricks"},{"@type":"ListItem","position":3,"name":"IP Functions are Generally Available, bringing high-performance network analytics to the Lakehouse"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ip-functions-are-generally-available-bringing-high-performance-network-analytics-to-the-lakehouse-1enn2q99j#faq","mainEntity":[{"@type":"Question","name":"What SQL function checks if an IP address falls inside a CIDR block in Databricks?","acceptedAnswer":{"@type":"Answer","text":"ip_cidr_contains(cidr, needle) tests whether an IP address falls within a given CIDR block, using an optimized range join built into the Databricks engine rather than string parsing or manual bitwise logic. It supports IPv4 and IPv6 uniformly and works with both STRING and BINARY representations, enabling threat-intel and geo-IP enrichment directly in SQL. daily.dev surfaces updates like this for engineers building threat-detection pipelines on SQL engines."}},{"@type":"Question","name":"Which Databricks Runtime version includes native IP functions like ip_host and ip_cidr_contains?","acceptedAnswer":{"@type":"Answer","text":"Native IP functions became Generally Available on Databricks Runtime 18.3 and above. The release includes functions such as ip_host, ip_cidr, ip_network, ip_prefix_length, ip_version, ip_as_binary, ip_as_string, and try_ safe variants that return NULL instead of erroring on malformed input, all accelerated by the query optimizer and Photon. Track lakehouse runtime upgrades like this on daily.dev before planning a migration."}},{"@type":"Question","name":"How much faster is Databricks ip_cidr_contains compared to traditional data warehouses for IP range joins?","acceptedAnswer":{"@type":"Answer","text":"Databricks remains 2x to as much as 6.4x cheaper than competing warehouses for IP range joins using ip_cidr_contains, with the performance advantage holding even as workloads scale to 10 billion IP addresses and 10 million CIDR blocks, at which point query speed across the industry begins to flatline. Developers weighing warehouse options for network analytics can follow benchmarks like this on daily.dev."}}]} ```