2

I am trying to find my old IP address in config files in order to replace it by my new IP address. I found one answer that proposes the command

sudo grep -HrnF '1.2.3.4' /

to find those IP addresses.

However, using this command directly, grep seems to hang. Before it hangs, it outputs some warnings that it cannot access some files inside /proc. Therefore I changed the command to

sudo grep -HrnFI --devices=skip '1.2.3.4' / > oldips.txt

But this time it wrote a 29 GB text file until I pressed Ctrl+C. After that I excluded the /proc directory like this:

 sudo grep -HrnFI --devices=skip --exclude-dir=/proc '1.2.3.4' / > oldips.txt

Is this a good way to find an IP address (or text in general) on the whole disk? If not, how would I need to change the command?

3
  • I suspect if you want to grep through your entire file system, it just will take ages. Perhaps limit it to a few directories that are more likely to contain the IP address. e.g. try /etc first (instead of /).
    – Sparhawk
    Mar 24, 2014 at 23:10
  • Well, if it does something, I can see CPU time being consumed (I'm checking with top) by grep, which I think it didn't using the first command, but it does using the last command. Mar 24, 2014 at 23:12
  • Sorry, I don't quite understand that comment. Are you saying that grep is doing something because it's using CPU? If so, yes, that's true, but it's going to take ages because it's reading through your entire file system. Instead, try something like sudo grep -HrnFI --devices=skip '1.2.3.4' /etc > oldips.txt
    – Sparhawk
    Mar 24, 2014 at 23:16

1 Answer 1

2

The likeliest problem is that it will be attempting to enter all the strange files in /sys and /proc and /dev (the first command at least, but /sys will still be an issue). Some of those will be long link chains all of which must be followed and none of which are actually of interest to you.

A much cleaner approach would be to use find and its exec option. Something like:

sudo find / -type f -exec grep -Flm 1 '1.2.3.4' {} +

The above command will find all regular files in / and run grep on them.

  • The -l means "print the matching file name", which is easier than printing the line and will probably increase your speed as well. Once you have the matching files, you can grep them at your leisure.

  • The -m 1 means "stop at the first match", this way large files will not need to be processed all the way through to the end if a match has been found.

  • The + at the end means that find will try and combine this into as few commands as possible (another reason why -l is needed, otherwise you won't know where the file came from). This is documented in man find:

       -exec command ;
              Execute  command;  true  if 0 status is returned.  All following
              arguments to find are taken to be arguments to the command until
              an  argument  consisting of `;' is encountered.  The string `{}'
              is replaced by the current file name being processed  everywhere
              it occurs in the arguments to the command, not just in arguments
              where it is alone, as in some versions of find.  Both  of  these
              constructions might need to be escaped (with a `\') or quoted to
              protect them from expansion by the shell.  See the EXAMPLES sec‐
              tion for examples of the use of the -exec option.  The specified
              command is run once for each matched file.  The command is  exe‐
              cuted  in  the starting directory.   There are unavoidable secu‐
              rity problems surrounding use of the -exec  action;  you  should
              use the -execdir option instead.
    
       -exec command {} +
              This  variant  of the -exec action runs the specified command on
              the selected files, but the command line is built  by  appending
              each  selected file name at the end; the total number of invoca‐
              tions of the command will  be  much  less  than  the  number  of
              matched  files.   The command line is built in much the same way
              that xargs builds its command lines.  Only one instance of  `{}'
              is  allowed  within the command.  The command is executed in the
              starting directory.
    

Before running that however, I would recommend you simply run this:

sudo find /etc -type f -exec grep -F '1.2.3.4' {} \;

The chances are ~90% that any configuration file that sets your IP will be in /etc. Specifically, it will probably be /etc/network/interfaces.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .