Showing posts with label regex. Show all posts
Showing posts with label regex. Show all posts

Friday, 15 March 2019

use regular expressions to find IP addresses

Good site for building regular expressions
https://regexr.com/

How to find IP the quick way and the exact way
https://www.regular-expressions.info/ip.html

Find IP (this will find 999.999.999.999 but you might not care
\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b

Below I was looking for 192.168.x.x
(192.168.)\d{1,3}\.\d{1,3}

Notes:
\b allows you to perform a "whole words only" search using a regular expression in the form of \bword\b. A "word character" is a character that can be used to form words. All characters that are not "word characters" are "non-word characters".

\d look for a digit

\d{1,3} look for between 1 to 3 digits

(192.168.) look for a group "192.168."


Example 1
Look for some thing with any character "." 
that is 1 or more long "{1,}"
followed by a new line (\n)
followed by any number of white space "(\s+)"
followed by IP address (simple) "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

(.{1,})(\n)(\s+)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})


White space characters
\t (tab)
\n (newline)
\s (any white space)
\s+ (any number of white space) 

Example 2
Looks for something(word) with any character 1 or more
any white space
IP address 

(.{1,})(\s)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Capture groups
(\n)(\t)
$1 = newline
$2 = tab


Example 3
Look for an IP address
Followed by 1 more more of any characters 
followed by "23/open" or "23/filtered" 
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(.{1,})(23\/open|23\/filtered)

Example 4
Find a newling / cr 
Find any character and a newline
(\n)(.{1,})(\n)(.{1,})

Good for finding extra lines of text to select them are remove