Updated Jul 14, 2026

Network

Batch-expand a file of CIDR ranges into hosts

Expand many CIDR ranges from one file.

Go · MIT license

Agent

overview

What decant-file does

When recon leaves a file of network blocks, decant-file is the managed Network node that reads cidr-addresses and writes one flat host list as FILE and FOLDER.

Cloud-range exports, ASN prefix dumps, or inventory CIDRs that must become concrete IPs before a scanner. No CLI flags; the file is the whole interface.

Use the single-address Decant variant for one range. For aggregation, slicing, or host counting instead of full expansion, mapcidr.

source github.com/Cgboal/Decant

use cases

Where decant-file fits

Expand many ranges at once

Read a file of CIDR blocks and emit every IP across all of them as one flat list, ready for a scanner or prober.

Normalize cloud and ASN ranges

Convert provider CIDR exports or ASN-derived prefixes into concrete addresses so downstream nodes enumerate the hosts inside them.

Feed a port scanner at scale

Hand the expanded addresses to naabu, rustscan, or masscan, which want a flat host list rather than network notation.

Standardize recon inputs

Turn a mixed set of network blocks into a uniform IP list early so every later stage reads the same format.

reference

decant-file inputs and flags

1 inputs
NameTypeFlagDescription
cidr-addressesFILE·File of CIDR ranges to expand into a flat list of IP addresses.

Showing key inputs. decant-file exposes 1 inputs in total.

example

Run decant-file

decant-file · command
# expand a file of CIDR ranges into a flat IP list
cat cidr-ranges.txt | decant > ips.txt
sample output
198.51.100.0
198.51.100.1
198.51.100.2
198.51.100.3
198.51.100.4
198.51.100.5
198.51.100.6
198.51.100.7
…  (512 IPs expanded from 198.51.100.0/24 and 203.0.113.0/24)

guidance

Choosing decant-file

Use decant-file when a file of CIDR ranges must become a flat IP list. For a single range, Decant is simpler. For CIDR aggregation and slicing rather than full expansion, mapcidr.

decant

Same expansion for one CIDR address instead of a file.

mapcidr

Aggregation, slicing, and expansion when a flat list is not enough.

prips

Prints each IP in a range. Comparable range-to-host primitive.

faq

decant-file questions

A file of CIDR ranges, one per line. decant-file expands every range and writes all addresses as a single flat IP list.

No. Decant expands ranges from stdin; the Trickest node exposes one cidr-addresses file input and no options. For slice, aggregate, or count instead of expand, use mapcidr.

decant-file only expands CIDR blocks into every address they contain. mapcidr adds aggregation, slicing, and host counting. prips is another range-to-IP primitive. Prefer decant-file when a flat host list is all you need.

Wire the decant-file file or folder output into the scanner. naabu and rustscan accept a flat host list from the prior node. Each tool expects concrete addresses, not CIDR notation in the input file.

Yes. A /24 yields all 256 addresses, including network and broadcast. Filter them downstream if the scanner should skip them.

When you have only one CIDR. Decant takes a single cidr-address; decant-file reads a whole file of ranges in one run.

Run decant-file yourself

A file of CIDR ranges feeds Decant file, which expands them all into individual IPs and passes them to naabu so the open ports land as output.

Facts on this page come from the live Trickest tool library.