Apr 17 2012

Extracting (unique) IPs from logfile

I have been messing around with some logfiles recently (related to honeypots as usual), and the following has been helpful whenever I wanted to extract IP addresses from them:

cat logfile.log | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u > /tmp/unique-ips.txt


    • blcspt on October 31, 2012 at 7:45 PM
    • Reply

    Grepping for IP addresses that way is awesome!
    Totally forgot about doing it that way as i mostly use grep and awk together

    Extracting IP addresses from kippo.log and listing how many separate connections each of them made:

    cat kippo.log | grep 'New connection:' | awk '{print $6}' | cut -d ':' -f1 | sort | uniq -c | sort -r


      • Ion on November 1, 2012 at 4:15 AM
      • Reply

      Hey Blackie, nice snippet! Thanks for your comment 🙂

    • b0bb3r5 on March 31, 2015 at 12:31 AM
    • Reply

    when i was attacked by a large botnet i found this useful (Updated command as kippo.log is the new log file name)

    cat /home/kippo/kippo/log/kippo.log.* | grep -o ‘[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}’ | sort -u > /tmp/unique-ips.txt

Leave a Reply

More in General News, Honeypots
Σαρκοβόρο για τα malware, στη διάθεσή σας!
Παγίδες για τα malware του κόσμου όλου!
Ωραίο SSH honeypot, αλλά για το σπιτάκι!
Γλυκές παγίδες!
New version of Kippo-Graph: 0.7.1