listing all ipv4 addresses from LOG using PCRE regex

I need to write a regular expression which will list all ip addresses from logs. The addresses should have different groups, so it should not match only to full match. The amount of ip addresses is not constant.
The log looks like this

<177>Jun 28 15:35:15 src=192.168.100.122 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Null scan (attempts with response: 144, attempts without response: 0, targets: 56, port(s): 443, 80, 5274, 445, 88, 4120, 135, 49155). targetList: 12.97.135.114, 18.232.35.16, 10.10.202.7, 10.101.90.178, 30.101.124.18, 13.107.3.128, 10.83.127.51, 12.160.91.170, 10.101.124.34, 10.10.200.12

Up to this moment I have written something like this:

targetList: ([0-9.,s]*)

But it merges all of the addresses to one big group, and every address should have only one group and it should not have a space or qoma signs.

Also I am using https://regex101.com/ to find a correct regex

After obtaining your one big group from the regex you posted, split it on /[s,]+/ (whitespace or comma) to obtain an array of individual IP addresses.
– FBergo
Jun 28 at 15:17

split

Can you write a full regex command?
– maro584
Jun 28 at 17:43

1 Answer
1

I tried the following regex for matching IPV4 Addresses and it worked successfully as shown in below link:-

https://regex101.com/r/JxzSb8/1

Regex for IPV4 Addresses :->

(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])

If you want to search IPV6 address you can use the following regex

Regex for IPV6 Addresses :->

((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?

Program for printing list of IPV4 addresses:->

#!/usr/bin/perl $num = '<177>Jun 28 15:35:15 src=192.168.100.122 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Null scan (attempts with response: 144, attempts without response: 0, targets: 56, port(s): 443, 80, 5274, 445, 88, 4120, 135, 49155). targetList: 12.97.135.114, 18.232.35.16, 10.10.202.7, 10.101.90.178, 30.101.124.18, 13.107.3.128, 10.83.127.51, 12.160.91.170, 10.101.124.34, 10.10.200.1'; print "num : $num"; print "nnList of IPV4 Addresses:->"; while ($num =~ m/((?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))/gm) { #matched text = $& print "n$1"; }

You can find a list of useful Regexes here on :->

https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Search This Blog

Mgiyuk