I am having a long list of IP addresses, which are not in sequence. I need to find how many IP addresses are there before/after a particular IP address. How can I achieve this?

  • 1
    Do you have duplicated IP?
    – cuonglm
    Jul 24, 2014 at 15:18
  • 1
    No. All IP addresses are unique. Jul 24, 2014 at 15:19
  • What does before/after mean for an IP address? In particular, do you have both IPv4 and IPv6 addresses? How do they compare?
    – vinc17
    Jul 24, 2014 at 15:20
  • Do you need the file sorted?
    – cuonglm
    Jul 24, 2014 at 15:21
  • 2
    @vinc17 - File only contains IP addresses (IPv4), no other data is included. If there are 1000 IP addresses in total, and match is found at 300th location, means there are 299 lines before the match and 700 lines after the match. Jul 24, 2014 at 15:28

8 Answers 8


Number of lines before and after a match, including the match (i.e. you need to subtract 1 from the result if you want to exclude the match):

sed -n '0,/pattern/p' file | wc -l
sed -n '/pattern/,$p' file | wc -l

But this has nothing to do with IP addresses in particular.


Maybe the easiest is,

sed -n '/pattern/{=; q;}' file

Thanks @JoshepR for pointing the error

  • This just prints the line number on which the pattern occurred.
    – Joseph R.
    Jul 24, 2014 at 15:45
  • @JosephR. - no, it prints every line number on which every match occurs.
    – mikeserv
    Jul 24, 2014 at 15:46
  • @mikeserv I know but the OP specified that IP addresses are unique. The OP also doesn't want the line number where the match(es) occurred; they want the number of lines before the pattern occurred and the number of lines after it.
    – Joseph R.
    Jul 24, 2014 at 15:48
  • @JosephR - the quickest way to arrive at those counts is to tally the line numbers - I would just pipe this directly to dc, myself, probably.
    – mikeserv
    Jul 24, 2014 at 15:49
  • @mikeserv I'm not arguing that the information from this answer isn't useful, I'm just saying that this code on its own doesn't do what the OP wants.
    – Joseph R.
    Jul 24, 2014 at 15:50

I did this two ways, though I think I like this best:

: $(( afterl=( lastl=$(wc -l <~/file) ) - 2 -
  $(( beforel=( matchl=$(sed -n "/$IP/{=;q;}" <~/file) ) - 1
)) ))
for n in last match afters befores
do  printf '%s line%s :\t%d\n' \
        "${n%s}" "${n##*[!s]}" $((${n%s}l))

That saves all of those as current shell variables - and evaluates them in the for loop afterwards for output. It counts the total lines in the file with wc and the gets the first matched line number with sed.

Its output:

last line :     1000
match line :    200
after lines :   799
before lines :  199

I also did:

sed -n "/$IP/=;\$=" ~/file |  
tr \\n \  | { 
IFS=' ' read ml ll 
printf '%s line%s:\t%d\n' \
    last '' $((ll=${ll##* }))
    match '' $ml \
    after s "$((al=ll-ml-1)) \ 
    before s $((bl=ml-1))

sed prints only matching and last line numbers, then tr translates the intervening \newlines to , and read reads the first of sed's results into $ml and all others into $ll. Possible multiple match cases are handled by stripping all but the last result out of $ll's expansion when setting it again later.

Its output:

last line :     1000
match line :    200
after lines :   799
before lines :  199

Both methods were tested on the file generated in the following way:

IP='some string for which I seek' 
for count in 1 2 3 4 5 
do  printf '%.199d%s\n' 0 "$IP" 
done | tr 0 \\n >~/file 

It does, by line number:

  1. sets the search string
  2. loops five times to ensure there will be multiple matches
  3. prints 199 zeroes then "$IP" then a \newline
  4. pipes output to tr - which translates zeroes to \newlines then into ~/file
  • Your "after" line count is off by one. If there are 1000 total lines, and the match is at line 200, then lines 201-1000 come after the match. That's 800 lines.
    – Jim L.
    May 17, 2023 at 17:23

Here's a little bit of Perl code that does it:

perl -ne '
     if(1 .. /192\.168\.1\.1/) { $before++ }
     else                      { $after++  }
     $before--; # The matching line was counted
     END{print "Before: $before, After: $after\n"}' your_file

This counts the total number of lines before and after the line containing the IP Replace with your desired IP.

Using nothing but Bash:

while read line;do
    if [ "$line" = ];then
    elif [ $match -eq 0 ];then
        after=$(($after + 1))
done < your_file
printf "Before: %d, After: %d\n" "$before" "$after"
  • BASH is preferred. Jul 24, 2014 at 15:29
  • 2
    @Joseph R.: Why don't you use $. instead of a counter?
    – cuonglm
    Jul 24, 2014 at 15:31
  • @Gnouc I could of course. I just think this is more readable than setting $after to $. - $before.
    – Joseph R.
    Jul 24, 2014 at 15:33
  • No, I mean: if matched, print $. - 1, save $. to $tmp. End print $. - $tmp. So we don't need counter for both before and after. Of course it's less readble than yours.
    – cuonglm
    Jul 24, 2014 at 15:38
  • @MandarShinde Please see the edit. I added a pure Bash answer.
    – Joseph R.
    Jul 24, 2014 at 15:41

An awk solution reporting number of lines before and after last match

awk '/192\.168\.1\.1/{x=NR};{y=NR} END{printf "before-%d, after-%d\n" , x-1, y-x}'  file

I was trying the following commands, which are a bit complicated, but would give accurate results:


a=$(cat file | wc -l) && b=$(cat -n file | grep <Pattern> | awk '{print $1}') && echo "$a - $b" | bc -l


echo "`cat -n file | grep <Pattern> | awk '{print $1}'`-1" | bc -l

Grep has a feature that can count the number of times a particular pattern is found. If you use the -c command that will do so. With the -c and -v command, this will count how many times this does not match a particular pattern


grep -c -v <pattern> file

So if you try something like:

grep -c -v 192.168.x.x file.log that should work.

  • This counts the number of occurrences of the target IP. This is not what the OP asked for.
    – Joseph R.
    Jul 24, 2014 at 15:21
  • I just edited it, if he is asking to count all other IPs before and after a particular IP, the edit should work for him.
    – ryekayo
    Jul 24, 2014 at 15:22

Using Raku (formerly known as Perl_6)

Take a random sample of 10 IP addresses, examine the 7th, get back two numbers (6 3), the first representing the number of lines before the targeted 7th IP, and the second representing the number of lines after the 7th IP:

~$ raku -e 'my @a = lines; my $b = @a.elems;  
            for @a.grep("", :k) {
                say $( $_, ($b-1) - $_, ) 
            };'  file


~$ raku -e 'say slurp.split(/^^ 194\.186\.137\.164 \n /).map: *.match(:global, "\n").elems;'  file

Sample Input (from https://catonmat.net/tools/generate-random-ip-addresses):

Sample Output (either code solution above):

(6 3)

Of course, you can assign the output into an @-sigiled array, and print a more pretty version using @array[0] and @array[1] indexing. Or if you prefer a different approach:

~$ raku -e 'for lines.kv -> $k,$v {  \
            if $v.match("") { 
            put "Lines before: $k\n", "Lines after:  ", lines.elems;}};'  file
Lines before: 6
Lines after:  3


~$ raku -ne 'state $i;  ++$i;  \
             put "Lines before: ", $i-1, "\nLines after:  ", lines.elems  \
             if .match("");'  file
Lines before: 6
Lines after:  3


~$ raku -ne 'state $i;  ++$i; state $j;  \
             if .match("") { $j = $i; put "Lines before: ", $i-1};  \
             END say "Lines after:  ", $i-$j;'  file
Lines before: 6
Lines after:  3

Note: the original problem says all IPs are unique so the code above fails for files with duplicate lines. But that is easily remedied. Testing on 10-line file where the IP in the 7th position gets copied into the 11th line position:

~$ raku -e 'my @a = lines; my $b = @a.elems;  \
            my @pos = @a.grep("", :k);  \
            for @pos -> $p {say ++$, ".\nLines before: $p\nLines after:  ", ($b-1) - $p, "\n"};'  file

Sample Output (note file is now 11-lines long):

Lines before: 6
Lines after:  4

Lines before: 10
Lines after:  0

Note: the first solution at the top of the page will handle multiple matches (i.e. duplicate IPs) as well.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .