Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have a honeypot set up and would like to analyse the sources of the many brute force attacks. I would like to extract all the IP addresses and add them in a list formation to another file. The script would then be part of a cron job with additional unique IP's appended to the bottom of the list file.
How do I extract IP addresses from a log file and list them in another file?
The easiest way would probably be a simple grep:
grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" /path/to/sourcefile > output.txt
This would extract all IP addresses from sourcefile and write them into output.txt, separated by a newline.
I'd use something like:
perl -MRegexp::Common -wnE 'say for /$RE{net}{IPv4}/g' log-file > another-file
This will require you to install the Perl module Regexp::Common, if it doesn't come packaged with your OS. The -n switch causes it to iterate line by line over the input file; it will then iterate over each occurrence of an IP address, and it'll print out each of those IP addresses to a separate line. The Regexp::Common module will have a pattern which matches IP addresses, which is available in $RE{net}{IPv4}.
I used awk to put ip addresses in an associate array named "i", using the match as the index. I then print the indexes, which de-duplicates the data.
awk 'match($0, /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {i[substr($0,RSTART,RLENGTH)]=1}END{for(ip in i){printf("%s\n", ip)}}' sourcefile
