IPs-LE

IPs-LE: One Address, One Spelling

Find every IP address, CIDR block and MAC in a document, normalized and classified, and refuse the ambiguous ones by name

IPv4 · IPv6 (RFC 5952) · CIDR · MAC — no DNS, no lookups, no sockets

---

Useful? A star or rating is how other developers find it —

★ GitHub ·

★ Open VSX ·

★ Marketplace

What it does

An allow-list review asks whether 2001:0db8::0001 is already on the list. The list says 2001:db8::1. A diff of the raw text calls them two addresses; they are one.

Open a document, run IPs-LE: Extract Addresses, and every IPv4 and IPv6 address, CIDR block and MAC address in it is listed by kind with its line and column, the key it sits under, its canonical form and what it is for — loopback, private, link-local, documentation and the rest. A CIDR block comes with its network, its last address and how many addresses it holds. The report opens beside the editor. Works in VS Code and in VS Code–based editors like Cursor and VSCodium (installable from Open VSX).

• Reviewing a config or an allow-list — one spelling per address, and the private ones named as private
• Reading a log — every peer and upstream, even inside a URL or a [host]:port
• Before trusting `010.1.1.1` — which is two different hosts depending on who reads it
• Across a project — every file that holds an address, and how many, in one table

Text it cannot read unambiguously is reported with the reason, never guessed at. It resolves nothing, looks nothing up and rewrites nothing.

Install

What it answers

One address, one form. IPv6 is normalized per RFC 5952 — 2001:0db8:0000:0000:0000:0000:0000:0001, 2001:db8:0:0:0:0:0:1, 2001:0db8::0001 and 2001:DB8::1 all come back as 2001:db8::1. Sorting the raw text gives four addresses; sorting the normalized form gives one.

Four kinds. ipv4, ipv6, cidr, mac.

Ten classes, closed. A class this cannot name is a class it does not claim.

An IPv4-mapped IPv6 address takes the IPv4 class, so ::ffff:127.0.0.1 is loopback rather than global — which is the miss an allow-list review is looking for.

Where it is. Line, column, and the key it sits under: JSON, YAML, TOML, INI, dotenv, CSV and logs all supply one. Everything else is still scanned — the search runs over the bytes, so a .tf, a .rules or a rotated access.log.1 yields its addresses and only loses the key path.

Blocks, with their arithmetic. A CIDR finding carries prefix, network, broadcast (IPv4 only — IPv6 has none), last and hosts. hosts is a decimal string, because ::/0 holds 2^128 addresses, which is one more than a u128 and far more than a JSON number.

{

"kind": "cidr", "text": "10.0.0.0/8", "normalized": "10.0.0.0/8", "class": "private", "cidr": { "prefix": 8, "network": "10.0.0.0", "broadcast": "10.255.255.255", "last": "10.255.255.255", "hosts": "16777216" } }

What it refuses

Where the text supports more than one reading, ips-le reports the text, names the ambiguity, and stops.

Six reasons, each a place where two answers are equally defensible:

The two that matter most:

• `010.1.1.1` is not resolved. A leading-zero octet is octal to some resolvers and decimal to others, so that text names two different hosts. Neither reading appears anywhere in the output — a tool that picked one would be the thing hiding the bug.
• `2130706433` is decoded only next to the flag. Under an address key it is reported as integer_form, with 127.0.0.1 inside the refusal message. What you never get is a loopback address quietly appearing in a list of addresses with the flag gone.

A refusal is a finding, not a failure. It does not move the exit code, and no filter can hide it — filtering to private still shows you the octal hazard, because that is the finding a filtered report would most regret dropping. --strict is there for the pipeline that wants an unresolved ambiguity to stop the build.

crate/SPEC.md says exactly when each reason fires.

It never touches a network

No DNS, no geolocation, no ASN, no WHOIS, no reachability check, no telemetry. Not behind a flag, not once. Classification is arithmetic over the bits and the IANA registries; a lookup would make the answer depend on the network the auditor happened to be sitting on.

It also never rewrites a file, and it never gives a verdict. It says what an address *is*, never whether it should be there.

Across a folder or a workspace

Extract reads the document you have open. A scan reads many files from disk and gives one report.

• The whole workspace: run IPs-LE: Scan Workspace for Addresses from the command palette.
• One folder: right-click it in the Explorer and choose Scan Folder for Addresses, or run IPs-LE: Scan Folder for Addresses and pick one.

The report opens with a table of every file that holds something, then has a section per file:

# IPs-LE workspace report

my-project · 113 file(s) read · 2 address(es), 1 could not be read

deploy/config.json · json (2)

• 3:14 · 2001:0db8:0000:0000:0000:0000:0000:0001 · ipv6 · → 2001:db8::1 · documentation · key upstream.host
• 5:12 · 192.0.2.10 · ipv4 · documentation · key peer

2 file(s) larger than the safety limit were not read.

What a scan reads. Files come from disk, so an unsaved edit is not seen. A file over the safety size, or one that is not UTF-8 text, is left unread. It stops at 5,000 files or 10,000 listed addresses. The report ends with a line for each thing it left out, so a short report is never mistaken for a clean project.

What it skips, and how to change that. Three switches are on by default, and each can be turned off on its own in Settings:

Two lists adjust the result without turning a switch off. To skip more, add a pattern to scanExcludes. To read something a switch would skip, add it to scanAlwaysInclude:

{

// Also skip the test fixtures. "ips-le.workspace.scanExcludes": ["/fixtures/"], // Read the vendored code, though the built-in list skips it. "ips-le.workspace.scanAlwaysInclude": ["/vendor/"] }

IPs-LE: Open Settings opens all of these in the Settings editor.

The built-in list

Folders, wherever they appear:

.git, .hg, .svn, node_modules, bower_components, jspm_packages, .pnpm-store, .yarn, vendor, site-packages, Pods, Carthage, dist, build, out, target, _build, _site, dist-newstyle, zig-out, storybook-static, cdk.out, DerivedData, CMakeFiles, .next, .nuxt, .output, .svelte-kit, .angular, .astro, .docusaurus, .vuepress, .expo, .turbo, .parcel-cache, .cache, .sass-cache, .jekyll-cache, .dart_tool, .pub-cache, .gradle, .kotlin, .cxx, .externalNativeBuild, captures, ephemeral, .symlinks, .swiftpm, .build, .bundle, .stack-work, .zig-cache, .godot, elm-stuff, .vercel, .netlify, .serverless, .aws-sam, .terraform, .venv, venv, __pycache__, .tox, .nox, .mypy_cache, .pytest_cache, .ruff_cache, .ipynb_checkpoints, .eggs, coverage, htmlcov, .nyc_output, .vscode-test, .idea, .vs, xcuserdata, *.egg-info

Files, wherever they appear:

*.min.js, *.min.css, *.map, *.snap, *.lock, package-lock.json, pnpm-lock.yaml, npm-shrinkwrap.json, go.sum, *.pbxproj, *.iml, local.properties, output-metadata.json, .flutter-plugins, .flutter-plugins-dependencies, .packages, Generated.xcconfig, flutter_export_environment.sh, GeneratedPluginRegistrant.*, fastlane/report.xml, fastlane/test_output/**, doc/api/**

Not on the list, because they are ordinary folders in many projects: bin, obj, tmp, logs, public, generated. A project that generates those ignores them in git, and the scan reads .gitignore.

What it could not read. Across a project there ca