Suricata

I think one way to support subnet lookups would be to add a mask transform to the rule lang, so you could do something like ip.src; mask:0xffffff00; datasets:isset, ....