Regex for IP after DST= but not after SRC=

Question

I'm searching for a special Regex, that recognizes an IP Adresses after a certain string.

That's the regex for the IP

(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))

The IP follows in my log to

DST=192.168.1.1

Which Regex do i need to just select a IP after DST= but not after SRC=

Answer 1

the problem is it finds DST=192.168.1.1 but it should only find 192.168.1.1

It depends a lot on the tool you use. For example with sed this might give you want you want.

echo "... SRC=10.1.1.1 DST=192.168.1.1 LEN=40 ..."  | \
sed -e 's/.*DST=\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/g'

192.168.1.1

See this article about regex grouping.

If you are trying to do highlighting this looks like what you may want/need. From the configuration.

# cs_re_s:<color>:<regular expression>
#             Like cs_re but only the substrings are used(!). E.g.:
#             ^....(...)...(...)
#             In the example above only what matches between '(' and ')' is
#             assigned a color. See the 'acctail' colorscheme for an example.

There is even an example that in that file close to what I believe you want. The example is cs_re_s:cyan:kernel: .*(SRC=[^ ]*) *(DST=[^ ]*) What you want which I think is to highlight anything following a DST may be cs_re_s:red:kernel: .*DST=([^ ]*).

Answer 2

DST=(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))

Answer 3

It can be done with lookbehind expression.

regex_test.txt content:

DST=192.168.1.1
SRC=192.168.1.1

then from command line:

   grep -P '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt

output:

DST=192.168.1.1

Edit

grep -Po '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt

output:

192.168.1.1