-2

I had a log file but I want to extract specific ip from the file the log file shown as below

enter image description here

for the logfile i only want to get the first part of IP of every line how every I try command below it came out a result which have a lot of IP that I dont want ( grep -E -o "([0-9]{1,3}[.]){3}[0-9]{1,3}" < honeylog.txt ) > output.txt

output.txt shown below

enter image description here

but the IP that i only want is the 1st part which only 192.168.80.12 got any ways that able to make the grep from every line hit the 1st result then directly skip to second line and start grep again ?

  • 1
    why not grep 192.168.80.12 directly? – RomanPerekhrest Jun 27 '17 at 20:41
  • @RomanPerekhrest Obviously the IP is not the same all the time. Otherwise a simple echo would be enough. – George Vasiliou Jun 27 '17 at 21:15
  • @GeorgeVasiliou, but the IP that i only want is the 1st part which only 192.168.80.12 – RomanPerekhrest Jun 27 '17 at 21:21
  • Thank for reply, it is a honeypot log currently I only use 1 machine to do testing therefore it only have one same ip. – dmxxiang Jun 28 '17 at 3:50
0

try configuring your grep as follows: grep -Po '(?<= - )[^ ]*'

I guess it depends on what sort of system you are on...-Po wont work on mac osx but it works fine on centos:

[rust@JBLGSMR001 ~]$ cat data.txt
2017-06-07-17:44:45.5903 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
2017-06-07-17:44:45.5904 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
2017-06-07-17:44:45.5905 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
2017-06-07-17:44:45.5906 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
2017-06-07-17:44:45.5907 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
2017-06-07-17:44:45.5908 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
2017-06-07-17:44:45.5909 tcp(6) - 192.168.80.12 58647 192.168.80.140 9999: 44 S [linux 2.2]
[rust@JBLGSMR001 ~]$ cat data.txt | grep -Po '(?<= - )[^ ]*' >> output.txt
[rust@JBLGSMR001 ~]$ cat output.txt
192.168.80.12
192.168.80.12
192.168.80.12
192.168.80.12
192.168.80.12
192.168.80.12
  • Thank you Jesse_b and sorry that im not very familliar with shell scripting did u means like like ? grep -Po '(?<= [0-9]{1,3}[.]){3}[0-9]{1,3} )[^honeylog.txt ]*output.txt' – dmxxiang Jun 28 '17 at 3:46
  • no, replace your whole grep command with the one I suggested so try: ? grep -Po '(?<= - )[^ ]*[^honeylog.txt ]*output.txt' – Jesse_b Jun 28 '17 at 14:39
  • thank you for your reply . I had tried to use command that suggested but it has no respond it have problem with ? command not found root@bt~/Desktop# ? grep -Po '(?<= - )[^ ]*[^honeylog.txt ]*output.txt' ? Command not found and i removed the ? like below thn the cursor stuck below root word there root@bt~/Desktop# grep -Po '(?<= - )[^ ]*[^honeylog.txt ]*output.txt' it look like processing but I wait long time no result come out . – dmxxiang Jun 30 '17 at 15:41
  • try running it like this: cat honeylog.txt | grep -Po '(?<= - )[^ ]*' >> output.txt – Jesse_b Jun 30 '17 at 15:45
  • Thanks a lot Jesse_b yes its worked it success grep the first ip but below also include the date time the output result like first category is 192.168.80.12 then seperate by ------------ and second category is 06-07-14:35:24.2331 , but this is enough at least you already helped me to filter out all the unnessesary ip so i can do 2nd time grep -Po '(?<= [0-9]{1,3}[.]){3}[0-9]{1,3} )[^outputtxt ]*output1.txt' – dmxxiang Jul 2 '17 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.