Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm new in ubuntu.

I have this IP regex '\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4}\b' I have a network pcap file, I want to use this regex and the grep -e to find all IP address in the file.

I tried: egrep '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}' -f Ncapture.pcap

How can I use the grep command to find IP in a network pcap file?

share|improve this question
    
Can you please post a small sample part of the pcap file? –  i08in Dec 12 '13 at 11:23
    
sure here a sample:/Downloads$ tcpdump -tttt -r Ncapture.pcap reading from file Ncapture.pcap, link-type EN10MB (Ethernet) 2013-01-12 18:37:42.871346 ARP, Request who-has 192.168.0.12 tell 192.168.0.1, length 46 2013-01-12 18:38:02.227995 IP 192.168.0.1.1901 > 239.255.255.250.1900: UDP, length 300 2013-01-12 18:38:02.231699 IP 192.168.0.1.1901 > –  c_motti Dec 12 '13 at 12:08
    
Please edit your question with the contents of the file. –  i08in Dec 12 '13 at 12:09

1 Answer 1

up vote 0 down vote accepted

Your egrep command is working for me, to make the grep -e work just escape the control characters, and to make it print only the IP-s use the -o option for grep:

tcpdump -nr Ncapture.pcap | grep -oe '\(\(25[0-5]\|2[0-4][0-9]\|[01]\?[0-9][0-9]\?\)\(\.\|$\)\)\{4\}'

But as I see this will print a dot at the end of the IP, if you don't like that, then you have to add the last octet separatly, i.e:

tcpdump -nr Ncapture.pcap | grep -oe '\(\(25[0-5]\|2[0-4][0-9]\|[01]\?[0-9][0-9]\?\)\(\.\|$\)\)\{3\}\(25[0-5]\|2[0-4][0-9]\|[01]\?[0-9][0-9]\?\)'

To make it only print an IP once:

tcpdump -nr Ncapture.pcap | grep -oe '\(\(25[0-5]\|2[0-4][0-9]\|[01]\?[0-9][0-9]\?\)\(\.\|$\)\)\{3\}\(25[0-5]\|2[0-4][0-9]\|[01]\?[0-9][0-9]\?\)' | sort | uniq
share|improve this answer
    
i tried this:grep -e ((25[0-5]\|2[0-4][0-9]\|[01]\?[0-9][0-9]\?)(\.\|$))\{4\} -f tcpdump.filename it didnt work for me. –  c_motti Dec 12 '13 at 12:45
    
thanks this is what i need :-) how can i print only the ip's ? –  c_motti Dec 12 '13 at 12:59
    
@c_motti I updated the answer. –  falconer Dec 12 '13 at 13:04
    
wow thanks this is what i need :-) –  c_motti Dec 12 '13 at 13:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.