«

»

Status update

I have been messing around with some logfiles recently (related to honeypots as usual), and the following has been helpful whenever I wanted to extract IP addresses from them:

cat logfile.log | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u > /tmp/unique-ips.txt

3 comments

  1. blcspt

    Grepping for IP addresses that way is awesome!
    Totally forgot about doing it that way as i mostly use grep and awk together

    Extracting IP addresses from kippo.log and listing how many separate connections each of them made:


    cat kippo.log | grep 'New connection:' | awk '{print $6}' | cut -d ':' -f1 | sort | uniq -c | sort -r

    12 98.76.54.32
    9 67.89.12.34
    3 109.87.65.43
    2 234.56.78.9
    1 109.87.65.43

    1. Ion

      Hey Blackie, nice snippet! Thanks for your comment 🙂

  2. b0bb3r5

    when i was attacked by a large botnet i found this useful (Updated command as kippo.log is the new log file name)

    cat /home/kippo/kippo/log/kippo.log.* | grep -o ‘[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}’ | sort -u > /tmp/unique-ips.txt

Leave a Reply

More in General News, Honeypots
Σαρκοβόρο για τα malware, στη διάθεσή σας!
Παγίδες για τα malware του κόσμου όλου!
Ωραίο SSH honeypot, αλλά για το σπιτάκι!
Γλυκές παγίδες!
New version of Kippo-Graph: 0.7.1
Close