0

I have a honeypot set up and would like to analyse the sources of the many brute force attacks. I would like to extract all the IP addresses and add them in a list formation to another file. The script would then be part of a cron job with additional unique IP's appended to the bottom of the list file.

How do I extract IP addresses from a log file and list them in another file?

0

3 Answers 3

9

The easiest way would probably be a simple grep:

grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" /path/to/sourcefile > output.txt

This would extract all IP addresses from sourcefile and write them into output.txt, separated by a newline.

3

I'd use something like:

perl -MRegexp::Common -wnE 'say for /$RE{net}{IPv4}/g' log-file > another-file

This will require you to install the Perl module Regexp::Common, if it doesn't come packaged with your OS. The -n switch causes it to iterate line by line over the input file; it will then iterate over each occurrence of an IP address, and it'll print out each of those IP addresses to a separate line. The Regexp::Common module will have a pattern which matches IP addresses, which is available in $RE{net}{IPv4}.

1
  • Arhh Brilliant. All worked fine. Thanks . Much appreciated. Commented Sep 20, 2017 at 10:52
3

I used awk to put ip addresses in an associate array named "i", using the match as the index. I then print the indexes, which de-duplicates the data.

awk 'match($0, /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {i[substr($0,RSTART,RLENGTH)]=1}END{for(ip in i){printf("%s\n", ip)}}' sourcefile

Not the answer you're looking for? Browse other questions tagged .