Given an excerpt of the firewall log file below,how would one extract/get the IP Address.GREP? SED? Is there any way of doing that?

th1 SRC=212.123.153.188 DST=11.11.11.82 LEN=404 TOS=0x00 PREC=0x00 TTL=114 ID=19
973 PROTO=UDP SPT=4429 DPT=1434 LEN=384

I'd probably use awk, e.g.

awk '{print $2,$3}' would print out the source and destination addresses of your first line. You could write a little script with awk, Perl, or Python to do some reporting if you wanted to.

Please explain a little bit more clearly or more precise.The excerpt info above is in a file.gz. Now,would awk'{print $2,$3}'<file.gz> work? And,if you cant write a script,is there another way to get all the IPs out.

No that would not because your file is in gz format. I think following command will work:

If you want only IP address, you can do something like this:

Thanks a lot. Here's what the first command gave me when I run it against the .gz file:
27 14:25:55
27 14:25:55
27 14:25:58
27 14:26:08
27 14:26:10
27 14:26:10
27 14:26:11
27 14:27:13
27 14:27:15

Below is what the second command gave me.

27 14:25:55
27 14:25:55
27 14:25:58
27 14:26:08
27 14:26:10
27 14:26:10
27 14:26:11
27 14:27:13
Im not quite sure what is the "27"?? Im assuming that "14:27:13" the IP address. Correct? Given the excerpt above.Sounds more like a time stamp..isnt it?

$ cat ext
th1 SRC=212.123.153.188 DST=11.11.11.82 LEN=404
th1 SRC=206.130.246.2 DST=11.11.11.100 LEN


$ awk 'BEGIN {FS="[ =]+"} {print $3, $5}' ext
212.123.153.188 11.11.11.82
206.130.246.2 11.11.11.100

looks like a timestamp, guessing the "27" is the 27th day of the month.


You may need to adjust the "$numbers" that are in those commands.

There are a ton of tutorials on how to use sed, and awk online. I would suggest reading over a few of them just to get a basic idea of how these commands work as they can be quite helpful.

When I run that command..here's what I get:

awk 'BEGIN {FS="[ =]+"} {print $3, $5}'anda.log.gz
awk: 1: unexpected character '.'

Two things. You wont be able to run awk on a gzip file. Either uncompress it first, or use zcat on the file, then pipe it into the awk command. Also you didn't put a space between the end of the awk command and the file name.

Eureka!! I found it..this command gives me the ip address out of the log file.Thanks a lot for all your help.

zcat anda.log.gz | sed 's/SRC=\|DST=//g' | awk '{print $12"\t"$13}' | more

This is just a portion of the output that I got:
.............. ...........
192.150.249.87 11.11.11.89
211.168.230.94 11.11.11.70
211.168.230.94 11.11.11.72
211.168.230.94 11.11.11.64
211.168.230.94 11.11.11.69
211.168.230.94 11.11.11.73
211.168.230.94 11.11.11.75
211.168.230.94 11.11.11.80
211.168.230.94 11.11.11.67
............. ..........
............. ..........

On a side note, instead of "more", use "less". It is wayyy better

moved to Linux - General as this isn't actually about networking in itself.

hope you found the information you're after.