Finding IP addresses using regular expression in python

Question

I am trying to parse the results of the TSHARK capture

Here is the line I am filtering on:

Internet Protocol, Src: 10.10.52.250 (10.10.52.250), Dst: 224.0.0.2 (224.0.0.2)

I am trying to extract the Src and Dst,

Here is my code to do that:

str(re.search("Src:\s[0-9\.]{7-15}", a, re.I|re.M).group())[5:]
str(re.search("Dst:\s[0-9\.]{7-15}", a, re.I|re.M).group())[5:]

I keep getting no match when I run this, but when I use the exact length of the IP address in the regular expression it works. ie

str(re.search("Src:\s[0-9\.]{9}", a, re.I|re.M).group())[5:]

Works just fine. How do I fix this problem?

Do you really want to match "..1234567890123" as a valid IP? — Kirk Strauser
– Kirk Strauser, Commented Oct 26, 2011 at 20:05

FailedDev · Accepted Answer · 2011-10-26 18:47:54Z

3

for match in re.finditer(r"\((\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))\b\)", subject):

This should match any IPV4 IP address. Actual IPs are captured into group 1.

While your regex may work, it is dangerous because 999.999.999.999 is not a valid but it will match.

answered Oct 26, 2011 at 18:47

FailedDev

27k9 gold badges56 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Franz Payer Over a year ago

I am writing a script that will have to parse traffic during a hacking competition, I need to be able to catch any packets crafted in scapy.They may not be valid IP addresses.

Kirk Strauser Over a year ago

But it's physically impossible to store 999.999.999.999 in an IP packet's address field, which is a 32-bit number. A single 8-bit octet from that field can never represent a decimal number > 255.

MetaEd · Accepted Answer · 2011-10-26 18:43:21Z

3

Looking at the Python regex howto, shouldn't that be {7,15}?

answered Oct 26, 2011 at 18:43

MetaEd

3,8901 gold badge31 silver badges31 bronze badges

1 Comment

Franz Payer Over a year ago

Thanks! That fixed it right away. I'm not quite sure how that worked the last time I tested the script at work.

Andrii Bovsunovskyi · Accepted Answer · 2011-10-26 18:57:55Z

2

Not very nice:

text = 'fasga@fas#2*^127.0.0.1tfgws5151'

pattern = r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
pattern_re = re.compile(pattern)
ip_address = pattern_re.findall(text)

answered Oct 26, 2011 at 18:57

Andrii Bovsunovskyi

714 bronze badges

Comments

chown · Accepted Answer · 2011-10-26 18:45:14Z

0

Try using {7,15}:

str(re.search("Src:\s[0-9\.]{7,15}", a, re.I|re.M).group())[5:]
str(re.search("Dst:\s[0-9\.]{7,15}", a, re.I|re.M).group())[5:]

Also, you should check that a group exists first (or put a try/except around it):

groupFound = re.search("Src:\s*[\d\.]{7,15}", a, re.I | re.M)
if groupFound:
    str(groupFound.group())[5:]

# or:

try:
    str(re.search("Src:\s*[\d\.]{7,15}", a, re.I | re.M).group())[5:]
except AttributeError:
    # handle it

answered Oct 26, 2011 at 18:45

chown

52.9k17 gold badges138 silver badges170 bronze badges

Collectives™ on Stack Overflow

Finding IP addresses using regular expression in python

4 Answers 4

2 Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related