Parse logfile for IPs, exclude internal IPs from output

[goober43543]

I have a script that reads the contents of several months of Firewall logs in a folder, using the following commands;

-------------------------
$input_path = ‘g:\logs\’
$output_file = ‘g:\logs\extracted_ip_addresses.txt’
$regex = ‘\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b’
select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
-------------------------

It outputs all IPs, on thier own, in the logs to the 'extracted_ip_addresses.txt' file, as follows

x.x.x.x
x.x.x.x
x.x.x.x
x.x.x.x

and so on. Which is great, but however, it populates 100k of IPs from my internal range of 192.168.x.x and 172.32.x.x

I would like to modify it to collect as normal, but exclude these ranges.

A final really great option, but not as critical, could it be also modified to avoid repetition, and only show the first instance of a particular IP?

Many thanks in advance.

 

[markdmac]

To remove the IPs in your range, use string manipulation to see if the left octet matches your ranges and if it does then ignore it. If not then create a dictionary object and add the IP to the dictionary. The dictionary will give you unique entries.

I hope that helps.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.