Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm searching for a special Regex, that recognizes an IP Adresses after a certain string.

That's the regex for the IP


The IP follows in my log to


Which Regex do i need to just select a IP after DST= but not after SRC=

share|improve this question
...have you tried sticking DST= in the front of the IP regex? Sometimes the simplest solution is the correct one :-) – voretaq7 Oct 8 '10 at 19:02
yes, sure :) but i just wanna mark the ipadress not also the string dst= – user56548 Oct 8 '10 at 19:23
@zordache: I'm using multitail. Tried your regex but it doesn't work. – user56548 Oct 8 '10 at 19:40
up vote 1 down vote accepted

the problem is it finds DST= but it should only find

It depends a lot on the tool you use. For example with sed this might give you want you want.

echo "... SRC= DST= LEN=40 ..."  | \
sed -e 's/.*DST=\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/g'

See this article about regex grouping.

If you are trying to do highlighting this looks like what you may want/need. From the configuration.

# cs_re_s:<color>:<regular expression>
#             Like cs_re but only the substrings are used(!). E.g.:
#             ^....(...)...(...)
#             In the example above only what matches between '(' and ')' is
#             assigned a color. See the 'acctail' colorscheme for an example.

There is even an example that in that file close to what I believe you want. The example is cs_re_s:cyan:kernel: .*(SRC=[^ ]*) *(DST=[^ ]*) What you want which I think is to highlight anything following a DST may be cs_re_s:red:kernel: .*DST=([^ ]*).

share|improve this answer
it doesn't work for multitail, gives me an error in regex - invalid back reference – user56548 Oct 8 '10 at 20:01
Great zoredache, muchas Gracias, it works, your help is highly appreciated – user56548 Oct 8 '10 at 21:56
share|improve this answer
the problem is it finds DST= but it should only find i'm searching for an expression that just finds the ip after DST= – user56548 Oct 8 '10 at 19:20
the braces should put the ip address into $1, $2, ... – krissi Oct 8 '10 at 19:51
No the braces do pattern repeating. I think you mean "parentheses". – Dennis Williamson Oct 10 '10 at 0:18

It can be done with lookbehind expression.

regex_test.txt content:


then from command line:

   grep -P '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt




grep -Po '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt

share|improve this answer
Change the -P to -Po to output only the IP address. – Dennis Williamson Oct 10 '10 at 0:21
You are right. My output statement does not state that it matches only IP. On my terminal DST= is green and is red so it is obvious. – Casual Coder Oct 10 '10 at 3:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.