«

»

Status update

I have been messing around with some logfiles recently (related to honeypots as usual), and the following has been helpful whenever I wanted to extract IP addresses from them:

cat logfile.log | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u > /tmp/unique-ips.txt
  • blcspt

    Grepping for IP addresses that way is awesome!
    Totally forgot about doing it that way as i mostly use grep and awk together

    Extracting IP addresses from kippo.log and listing how many separate connections each of them made:


    cat kippo.log | grep 'New connection:' | awk '{print $6}' | cut -d ':' -f1 | sort | uniq -c | sort -r

    12 98.76.54.32
    9 67.89.12.34
    3 109.87.65.43
    2 234.56.78.9
    1 109.87.65.43

    • http://bruteforce.gr Ion

      Hey Blackie, nice snippet! Thanks for your comment :)

Powered by WordPress and the Graphene Theme.

More in General News, Honeypots
Σαρκοβόρο για τα malware, στη διάθεσή σας!
Παγίδες για τα malware του κόσμου όλου!
Ωραίο SSH honeypot, αλλά για το σπιτάκι!
Γλυκές παγίδες!
New version of Kippo-Graph: 0.7.1
Close